Vulnerabilities > CVE-2022-2240 - Improper Neutralization of Formula Elements in a CSV File vulnerability in Emarketdesign Request a Quote

047910
CVSS 8.8 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
network
low complexity
emarketdesign
CWE-1236
NVD
Published: 2022-07-25
Updated: 2022-07-29

Summary

The Request a Quote WordPress plugin through 2.3.7 does not validate uploaded CSV files, allowing unauthenticated users to attach a malicious CSV file to a quote, which could lead to a CSV injection once an admin download and open it

Vulnerable Configurations

Part Description Count
Application
Emarketdesign
26

Common Weakness Enumeration (CWE)

References