CVE-2020-22277

Import and export users and customers WordPress Plugin through 1.15.5.11 allows CSV injection via a customer's profile.

CVSS v3 8.0 HIGH
CVSS v2.0 6.0 MEDIUM

8.0^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.1 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.0^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:S/C:P/I:P/A:P

Exploitability : 6.8 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://cert.ikiu.ac.ir/public-files/news/document/CVE-99/CVE-2020-22277.pdf	Exploit Third Party Advisory
https://mega.nz/file/bSQnlS4R#UY_ozLkvXgXFKzqtTRKeB9RXGi6aEQF3X6eKXdSiBt0	Exploit Third Party Advisory
https://wordpress.org/plugins/import-users-from-csv-with-meta/#:~:text=Install%20Import%20and%20export%20users%20and%20customers%20automatically%2Cis%20uploaded%20and%20extracted%2C%20click%20Activate%20Plugin%20.
https://cert.ikiu.ac.ir/public-files/news/document/CVE-99/CVE-2020-22277.pdf	Exploit Third Party Advisory
https://mega.nz/file/bSQnlS4R#UY_ozLkvXgXFKzqtTRKeB9RXGi6aEQF3X6eKXdSiBt0	Exploit Third Party Advisory
https://wordpress.org/plugins/import-users-from-csv-with-meta/#:~:text=Install%20Import%20and%20export%20users%20and%20customers%20automatically%2Cis%20uploaded%20and%20extracted%2C%20click%20Activate%20Plugin%20.

Configurations

Configuration 1 (hide)

cpe:2.3:a:codection:import_and_export_users_and_customers:*:*:*:*:*:wordpress:*:*

History

21 Nov 2024, 05:13

Type	Values Removed	Values Added
References	~~() https://cert.ikiu.ac.ir/public-files/news/document/CVE-99/CVE-2020-22277.pdf - Exploit, Third Party Advisory~~	() https://cert.ikiu.ac.ir/public-files/news/document/CVE-99/CVE-2020-22277.pdf - Exploit, Third Party Advisory
References	~~() https://mega.nz/file/bSQnlS4R#UY_ozLkvXgXFKzqtTRKeB9RXGi6aEQF3X6eKXdSiBt0 - Exploit, Third Party Advisory~~	() https://mega.nz/file/bSQnlS4R#UY_ozLkvXgXFKzqtTRKeB9RXGi6aEQF3X6eKXdSiBt0 - Exploit, Third Party Advisory
References	() https://wordpress.org/plugins/import-users-from-csv-with-meta/#:~:text=Install%20Import%20and%20export%20users%20and%20customers%20automatically%2Cis%20uploaded%20and%20extracted%2C%20click%20Activate%20Plugin%20. -	() https://wordpress.org/plugins/import-users-from-csv-with-meta/#:~:text=Install%20Import%20and%20export%20users%20and%20customers%20automatically%2Cis%20uploaded%20and%20extracted%2C%20click%20Activate%20Plugin%20. -

07 Nov 2023, 03:19

Type	Values Removed	Values Added
References	{'url': 'https://wordpress.org/plugins/import-users-from-csv-with-meta/#:~:text=Install%20Import%20and%20export%20users%20and%20customers%20automatically,is%20uploaded%20and%20extracted%2C%20click%20Activate%20Plugin%20.', 'name': 'https://wordpress.org/plugins/import-users-from-csv-with-meta/#:~:text=Install%20Import%20and%20export%20users%20and%20customers%20automatically,is%20uploaded%20and%20extracted%2C%20click%20Activate%20Plugin%20.', 'tags': ['Product', 'Release Notes', 'Third Party Advisory'], 'refsource': 'MISC'}	() https://wordpress.org/plugins/import-users-from-csv-with-meta/#:~:text=Install%20Import%20and%20export%20users%20and%20customers%20automatically%2Cis%20uploaded%20and%20extracted%2C%20click%20Activate%20Plugin%20. -

Information

Published : 2020-11-04 17:15

Updated : 2024-11-21 05:13

NVD link : CVE-2020-22277

Mitre link : CVE-2020-22277

CVE.ORG link : CVE-2020-22277

JSON object : View

Products Affected

codection

import_and_export_users_and_customers

CWE

CWE-1236

Improper Neutralization of Formula Elements in a CSV File

8.0 /10