CVE-2020-7947

Katalog CVE

CVSS 9.8 · Critical EPSS 2,8%

Kerentanan Improper Neutralization of Formula Elements in a CSV File pada login by auth0. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. It has numerous fields that can contain data that is pulled from different sources. One issue with this is that the data isn't sanitized, and no input validation is performed, before the exporting of the user data. This can lead to (at least) CSV injection if a crafted Excel document is uploaded.

Rincian

Terbit di NVD

1 April 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1236: Improper Neutralization of Formula Elements in a CSV File

EPSS (30 hari)

2,8% peluang dieksploitasi; lebih tinggi dari 86,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://auth0.com/docs/cms/wordpress product · advisory vendor
• https://auth0.com/docs/security/bulletins/2020-03-31_wpauth0 advisory pihak ketiga
• https://github.com/auth0/wp-auth0/security/advisories/GHSA-59vf-cgfw-6h6v advisory pihak ketiga
• https://wordpress.org/plugins/auth0/#developers release notes · advisory pihak ketiga