PT-2020-10361 · Tablepress · Tablepress

Globalbpa · Published 2020-01-09 · Updated 2024-08-05 · CVE-2019-20180

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TablePress plugin version 1.9.2

Description The issue allows tablepress[data] CSV injection by Editor users. This could potentially lead to malicious actions when the CSV file is opened by an application. Note that the vendor disputes this issue, arguing that the responsibility lies with the application that opens the CSV file, not TablePress.

Recommendations For TablePress plugin version 1.9.2, consider restricting Editor user access to mitigate the risk of CSV injection until a resolution is provided by the vendor. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

CVE-2019-20180

Affected Products

Tablepress

References · 8

• 🔥 https://medium.com/@Pablo0xSantiago/cve-2019-20180-tablepress-version-1-9-2-csv-injection-65309fcc8be8 · Exploit
• https://osv.dev/vulnerability/CVE-2019-20180 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-20180 · Security Note
• https://wordpress.org/support/topic/security-issue-cve-2019-20180-for-tablepress/#post-16282996 · Note
• https://t.me/cvenotify/80489 · Telegram Post
• https://t.me/cvenotify/40183 · Telegram Post
• https://medium.com/%40Pablo0xSantiago/cve-2019-20180-tablepress-version-1-9-2-csv-injection-65309fcc8be8 · Note
• https://wpvulndb.com/vulnerabilities/10016 · Note