CVE-2022-2240 Request a Quote <= 2.3.7 - CSV Injection

Q: What is CVE-2022-2240?

CVE-2022-2240 is a high-severity vulnerability in Unknown Request a Quote, published on 25 Jul 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Q: Is CVE-2022-2240 being exploited?

There is no known exploitation of CVE-2022-2240 in the wild and no public exploit code.

Q: How do I fix CVE-2022-2240?

No fix has been published for CVE-2022-2240 yet. Limit exposure of the affected software until one is available.

High 8.8 Published 25 Jul 2022 Updated 3 Aug 2024

Unauthenticated attackers can inject malicious formulas into CSV files, leading to code execution when an admin opens the downloaded quote.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2022-2240?

CVE-2022-2240 is a high-severity vulnerability in Unknown Request a Quote, published on 25 Jul 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The Request a Quote WordPress plugin through 2.3.7 does not validate uploaded CSV files, allowing unauthenticated users to attach a malicious CSV file to a quote, which could lead to a CSV injection once an admin download and open it

Weakness: CWE-1236

Which versions are affected by CVE-2022-2240?

It affects 1 product.

Products include Emarketdesign Request a Quote.

How do I fix CVE-2022-2240?

No fix has been published for CVE-2022-2240 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-2240 being exploited?

There is no known exploitation of CVE-2022-2240 in the wild and no public exploit code.

Sources

Also known as GHSA-c759-j56j-j6v3.