WordPress Simple History Plugin <= 3.3.1 is vulnerable to CSV Injection
CVE-2022-45350

3LOW

Key Information:

Vendor

WordPress
Status
Simple History – User Activity Log, Audit Tool
Vendor
CVE Published:
7 November 2023

What is CVE-2022-45350?

A vulnerability has been identified in the Simple History plugin, which may allow an attacker to craft malicious CSV files. This can lead to improper execution of commands when opened in a vulnerable environment, thereby compromising user data integrity. It is crucial for users to update to the latest versions to mitigate this risk and protect sensitive information from unauthorized access.

Affected Version(s)

Simple History – user activity log, audit tool <= 3.3.1

References

https://patchstack.com/database/vulnerability/simple-hist...
vdb-entry

CVSS V3.1

Score:
3
Severity:
LOW
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ed32.dll (Patchstack)
.