CVE-2019-20180 in TablePress Plugin

الملخص

بحسب MITRE

The TablePress plugin 1.9.2 for WordPress allows tablepress[data] CSV injection by Editor users. Note: The vendor disputes this issue and argues that this responsibility lies with the application that opens the CSV file and not TablePress.

Be aware that VulDB is the high quality source for vulnerability data.

• حجز: 31/12/2019
• الاعتدال: تمت الموافقة
• إدخال: VDB-148514
• CPE: جاهز
• CWE: CWE-436 (مؤكد)
• CVSS: 6.8 (NVD)
• EPSS: 0.02326
• KEV: لا
• النشاطات: منخفض جدًا
• القطاع: Hostingprovider

المصادر

• MITRE: https://www.cve.org/CVERecord?id=CVE-2019-20180
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2019-20180
• CVE Details: https://www.cvedetails.com/cve/CVE-2019-20180/