nvd-json-data-feeds/CVE-2020/CVE-2020-115xx/CVE-2020-11548.json

{
  "id": "CVE-2020-11548",
  "sourceIdentifier": "cve@mitre.org",
  "published": "2020-04-05T00:15:11.940",
  "lastModified": "2021-07-21T11:39:23.747",
  "vulnStatus": "Analyzed",
  "descriptions": [
    {
      "lang": "en",
      "value": "The Search Meter plugin through 2.13.2 for WordPress allows user input introduced in the search bar to be any formula. The attacker could achieve remote code execution via CSV injection if a wp-admin/index.php?page=search-meter Export is performed."
    },
    {
      "lang": "es",
      "value": "El plugin Search Meter versiones hasta 2.13.2 para WordPress, permite que la entrada del usuario introducida en la barra de b\u00fasqueda sea cualquier f\u00f3rmula. El atacante podr\u00eda lograr una ejecuci\u00f3n de c\u00f3digo remota por medio de una inyecci\u00f3n CSV si una Exportaci\u00f3n de wp-admin/index.php?page=search-meter es realizada."
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "accessVector": "NETWORK",
          "accessComplexity": "LOW",
          "authentication": "NONE",
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5
        },
        "baseSeverity": "HIGH",
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1236"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:search_meter_project:search_meter:*:*:*:*:*:wordpress:*:*",
              "versionEndIncluding": "2.13.2",
              "matchCriteriaId": "18DAD4EA-EC82-4E42-979D-82003C0F8794"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://wordpress.org/plugins/search-meter/#developers",
      "source": "cve@mitre.org",
      "tags": [
        "Product",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://www.exploit-db.com/exploits/48197",
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ]
    }
  ]
}