CVE-2020-11548

CRITICAL

9.8

Descricao

The Search Meter plugin through 2.13.2 for WordPress allows user input introduced in the search bar to be any formula. The attacker could achieve remote code execution via CSV injection if a wp-admin/index.php?page=search-meter Export is performed.

Detalhes CVE

Pontuacao CVSS v3.19.8

SeveridadeCRITICAL

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosNONE

Interacao do usuarioNONE

Publicado4/5/2020

Ultima modificacao11/21/2024

Fontenvd

Avistamentos honeypot0

Produtos afetados

search_meter_project:search_meter

Fraquezas (CWE)

CWE-1236

Referencias

https://wordpress.org/plugins/search-meter/#developers(cve@mitre.org)

https://www.exploit-db.com/exploits/48197(cve@mitre.org)

https://wordpress.org/plugins/search-meter/#developers(af854a3a-2127-422b-91ae-364da2661108)

https://www.exploit-db.com/exploits/48197(af854a3a-2127-422b-91ae-364da2661108)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.