CVE-2020-36503 Connections Business Directory < 9.7 - Admin+ CSV Injection

Q: What is CVE-2020-36503?

CVE-2020-36503 is a high-severity vulnerability in Unknown Connections Business Directory, published on 1 Nov 2021. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Q: Is CVE-2020-36503 being exploited?

There is no known exploitation of CVE-2020-36503 in the wild and no public exploit code.

Q: How do I fix CVE-2020-36503?

No fix has been published for CVE-2020-36503 yet. Limit exposure of the affected software until one is available.

High 8.0 Published 1 Nov 2021 Updated 4 Aug 2024

An attacker with admin privileges can inject malicious formulas into CSV exports, potentially leading to code execution when the file is opened.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2020-36503?

CVE-2020-36503 is a high-severity vulnerability in Unknown Connections Business Directory, published on 1 Nov 2021. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

The Connections Business Directory WordPress plugin before 9.7 does not validate or sanitise some connections' fields, which could lead to a CSV injection issue

Weakness: CWE-1236

Which versions are affected by CVE-2020-36503?

It affects 1 product.

Products include Connections-Pro Connections Business Directory.

How do I fix CVE-2020-36503?

No fix has been published for CVE-2020-36503 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-36503 being exploited?

There is no known exploitation of CVE-2020-36503 in the wild and no public exploit code.

Sources

Also known as GHSA-cv8q-93v6-rxm5.