High severity · published Jun 16, 2017
CVE-2016-1000222
Logstash prior to version 2.1.2, the CSV output can be attacked via engineered input that will create malicious formulas in the CSV data
7.5
CVSS
1.1%
EPSS
No
On KEV
Description
Logstash prior to version 2.1.2, the CSV output can be attacked via engineered input that will create malicious formulas in the CSV data.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LO
Logstash · Elastic
through 2.1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-1000222
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-1000222
Vendor Advisory
https://www.elastic.co/community/security
More from Logstash
9.8
CVE-2026-33466
Improper Limitation of a Pathname to a Restricted Directory in Logstash Leading to Arbitrary File Write
9.8
CVE-2019-7612
A sensitive data disclosure flaw was found in the way Logstash versions before 5.6.15 and 6.6.1 logs malformed URLs
7.5
CVE-2019-7620
Logstash versions before 7.4.1 and 6.8.4 contain a denial of service flaw in the Logstash Beats input plugin
7.5
CVE-2015-5378
Logstash 1.5.x before 1.5.3 and 1.4.x before 1.4.4 allows remote attackers to read communications between Logstash Forwarder agent and Logstash server
7.5
CVE-2016-10363
Logstash versions prior to 2.3.3, when using the Netflow Codec plugin, a remote attacker crafting malicious Netflow v5, Netflow v9 or IPFIX packets could perform a denial of…