CVE-2022-2240CWE-1236

Request a Quote <= 2.3.7 - CSV Injection

published July 25, 2022

CVSS
—
EPSS
1%
Percentile
72.7
In the wild
Unconfirmed
What it is

The Request a Quote WordPress plugin through 2.3.7 does not validate uploaded CSV files, allowing unauthenticated users to attach a malicious CSV file to a quote, which could lead to a CSV injection once an admin download and open it

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01426 · 72.7th percentile
Weakness
CWE-1236 · Improper Neutralization of Formula Elements in a CSV File
Published
2022-07-25T12:47Z
EPSS history
Timeline
  • 25 JUL 12:47Z
    Request a Quote <= 2.3.7 - CSV Injection
    cvelistv5