CVE-2022-4034CWE-1236

Appointment Hour Booking <= 1.3.72 - CSV Injection

Medium · published November 29, 2022

CVSS v3.1
5.8
EPSS
1%
Percentile
51.7
In the wild
Unconfirmed
What it is

The Appointment Hour Booking Plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.3.72. This makes it possible for unauthenticated attackers to embed untrusted input into content during booking creation that may be exported as a CSV file when a site's administrator exports booking details. This can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.

The record
Technical detail
CVSS v3.1
5.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00678 · 51.7th percentile
Weakness
CWE-1236 · Improper Neutralization of Formula Elements in a CSV File
Published
2022-11-29T20:30Z
EPSS history
Timeline
  • 29 NOV 20:30Z
    Appointment Hour Booking <= 1.3.72 - CSV Injection
    cvelistv5