CVE-2022-2429
Published: 06 September 2022
Summary
CVE-2022-2429 is a medium-severity Improper Neutralization of Special Elements (CWE-138) vulnerability in Ultimatesmsnotifications Ultimate Sms Notifications For Woocommerce. Its CVSS base score is 6.5 (Medium).
Operationally, ranked in the top 25.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-34690
Vulnerability details
The Ultimate SMS Notifications for WooCommerce plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.4.1 via the 'Export Utility' functionality. This makes it possible for authenticated attackers, such as a subscriber, to add untrusted…
more
input into billing information like their First Name that will embed into the exported CSV file triggered by an administrator and can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.