CVE-2019-17661
Last modified
CVE-2019-17661 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. A CSV injection in the codepress-admin-columns (aka Admin Columns) plugin 3.4.6 for WordPress allows malicious users to gain remote control of other computers. By choosing formula code as his first or last name, an attacker can create a user with a name that contains malicious code. EPSS estimates a 2.39% chance of exploitation in the next 30 days.
Description
A CSV injection in the codepress-admin-columns (aka Admin Columns) plugin 3.4.6 for WordPress allows malicious users to gain remote control of other computers. By choosing formula code as his first or last name, an attacker can create a user with a name that contains malicious code. Other users might download this data as a CSV file and corrupt their PC by opening it in a tool such as Microsoft Excel. The attacker could gain remote access to the user's PC.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Admincolumns | Admin Columns | 3.4.6 |
References
- https://www2.deloitte.com/de/de/pages/risk/articles/wordpress-csv-injection.htmlExploit, Third Party Advisory
- https://www2.deloitte.com/de/de/pages/risk/articles/wordpress-csv-injection.htmlExploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-17661?
How severe is CVE-2019-17661?
How do I fix CVE-2019-17661?
Are you affected by CVE-2019-17661?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST