PT-2023-14285 · WordPress · Wp Csv

Mesut Cetin · Published 2023-01-09 · Updated 2023-01-13 · CVE-2022-4368

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WP CSV WordPress plugin versions 1.8.0.0 and earlier

Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the plugin does not properly sanitize and escape a parameter before outputting it back in the page when importing a CSV. Additionally, the plugin lacks CSRF checks. This can lead to a Reflected Cross-Site Scripting attack.

Recommendations For WP CSV WordPress plugin versions 1.8.0.0 and earlier, consider updating to a version that addresses the sanitization and escaping of parameters, as well as implements CSRF checks. As a temporary workaround, restrict access to the CSV import functionality to minimize the risk of exploitation. Avoid using the vulnerable parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2022-4368

Affected Products

Wp Csv

References · 4

• 🔥 https://wpscan.com/vulnerability/fa7e2b64-ca48-4b76-a2c2-f5e31e42eab7 · Exploit
• https://osv.dev/vulnerability/CVE-2022-4368 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-4368 · Security Note
• https://t.me/cvenotify/41658 · Telegram Post