Lucene search

GoogleOSV:GHSA-RCMF-88P4-9WRG

HistoryMay 24, 2022 - 5:21 p.m.

WooCommerce Cross-Site Request Forgery (CSRF)

2022-05-2417:21:15

Google

osv.dev

woocommerce

csrf

xss

product importer

csv

vulnerability

AI Score

6.1

Confidence

High

EPSS

0.001

Percentile

41.1%

JSON

WooCommerce before 3.6.5, when it handles CSV imports of products, has a cross-site request forgery (CSRF) issue with resultant stored cross-site scripting (XSS) via includes/admin/importers/class-wc-product-csv-importer-controller.php.

References

blog.ripstech.com/2019/woocommerce-csrf-to-stored-xss

github.com/woocommerce/woocommerce

github.com/woocommerce/woocommerce/commit/fd7feb778eb45a2eb92b45eb2b4ee96ea3ac6fe7

nvd.nist.gov/vuln/detail/CVE-2019-20891

raw.githubusercontent.com/woocommerce/woocommerce/master/CHANGELOG.txt