PT-2020-10856 · Automattic · Woocommerce

Published 2020-06-19 · Updated 2022-05-24 · CVE-2019-20891

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WooCommerce versions prior to 3.6.5

Description The issue arises when WooCommerce handles CSV imports of products, leading to a cross-site request forgery (CSRF) problem that results in stored cross-site scripting (XSS). This occurs via the includes/admin/importers/class-wc-product-csv-importer-controller.php file.

Recommendations For versions prior to 3.6.5, update to version 3.6.5 or later to resolve the issue.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2019-20891

GHSA-RCMF-88P4-9WRG

Affected Products

Woocommerce

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2019-20891 · Security Note
• https://osv.dev/vulnerability/CVE-2019-20891 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rcmf-88p4-9wrg · Vendor Advisory
• https://github.com/woocommerce/woocommerce/commit/fd7feb778eb45a2eb92b45eb2b4ee96ea3ac6fe7 · Note
• https://github.com/woocommerce/woocommerce · Note
• https://blog.ripstech.com/2019/woocommerce-csrf-to-stored-xss · Note
• https://raw.githubusercontent.com/woocommerce/woocommerce/master/CHANGELOG.txt · Note