PT-2019-13982
CVE-2019-15092
·
تاريخ النشر
2019-08-22
·
تاريخ التحديث
2020-08-24
الوصف من
CVSS 3.1
7.3
عاليةالمقاييسAV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
webtoffee WordPress Users & WooCommerce Customers Import Export plugin version 1.3.0
Description
The issue allows CSV injection in the
user url, display name, first name, and last name columns in an exported CSV file created by the WF CustomerImpExpCsv Exporter class.Recommendations
For version 1.3.0, consider avoiding the use of the
WF CustomerImpExpCsv Exporter class until a patch is available. As a temporary workaround, restrict the export functionality to minimize the risk of exploitation. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾