Paper/Archive/CVE-2022-3603

CVE-2022-3603

Unknown Export customers list csv for WooCommerce, WordPress users csv, export Guest customer list — Export customers list CSV for WooCommerce < 2.0.69 - CSV Injection

EPSS 1%public exploit CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD, ADP agree)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 66.8.668 × 2013.4 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

The Export customers list csv for WooCommerce, WordPress users csv, export Guest customer list WordPress plugin before 2.0.69 does not validate data when outputting it back in a CSV file, which could lead to CSV injection.

Affected

ProductAffectedFixed inSource

Export customers list csv for WooCommerce, WordPress users csv, export Guest customer list< 2.0.692.0.69CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: partial

References

exploitwpscan.com/vulnerability/376e2bc7-2eb9-4e0a-809c-1582940ebdc7