CVE-2019-16120

Опубликовано: 08 сент. 2019

Источник: nvd

CVSS3: 8.8

CVSS2: 6.5

EPSS Низкий

Описание

CSV injection in the event-tickets (Event Tickets) plugin before 4.10.7.2 for WordPress exists via the "All Post> Ticketed > Attendees" Export Attendees feature.

Ссылки

https://wordpress.org/plugins/event-tickets/#developers
Product
Release Notes
https://wpvulndb.com/vulnerabilities/9858
Third Party Advisory
https://www.exploit-db.com/exploits/47335
Exploit
Third Party Advisory
VDB Entry
https://wordpress.org/plugins/event-tickets/#developers
Product
Release Notes
https://wpvulndb.com/vulnerabilities/9858
Third Party Advisory
https://www.exploit-db.com/exploits/47335
Exploit
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:liquidweb:event_tickets:*:*:*:*:*:wordpress:*:*

Версия до 4.10.7.2 (исключая)

EPSS

Процентиль: 86%

0.02856

Низкий

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-1236

Связанные уязвимости

GHSA-6c4h-j469-9cv8