CVE-2022-4034 - Appointment Hour Booking <= 1.3.72

Back Back to CVE browser

HIGH

Appointment Hour Booking <= 1.3.72 - CSV Injection

Published Nov 29, 2022

7.8

HIGH

CVSS 3.1

EPSS 0.68%

Description

The Appointment Hour Booking Plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.3.72. This makes it possible for unauthenticated attackers to embed untrusted input into content during booking creation that may be exported as a CSV file when a site's administrator exports booking details. This can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.

Affected products

Vendor Codepeople Product Appointment Hour Booking – Booking Calendar Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=1.3.72

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Codepeople

Appointment Hour Booking – Booking Calendar

unaffected

Version	Status	Constraints
0	affected	<=1.3.72

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-1236

References (4)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-51413		Advisory
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2803896%40appointment-hour-booking&new=2803896%40appointment-hour-booking&sfp_email=&sfph_mail=		PatchThird Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/b3a77b7a-65ad-4334-99c9-92cc79e60bee?source=cve
https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4034		Third Party Advisory