CVE-2024-3214 Relevanssi – A Better Search <= 4.22.1 - Unauthenticated Second Order CSV Injection
Unauthenticated attackers can inject malicious formulas into CSV exports, leading to code execution when opened in vulnerable spreadsheet applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-3214?
CVE-2024-3214 is a medium-severity code injection vulnerability in Relevanssi Premium, published on 9 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Relevanssi – A Better Search plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 4.22.1. This makes it possible for unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.
Weakness: CWE-1236
Which versions are affected by CVE-2024-3214?
It affects 1 product.
Products include Relevanssi Relevanssi.
How do I fix CVE-2024-3214?
No fix has been published for CVE-2024-3214 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-3214 being exploited?
There is no known exploitation of CVE-2024-3214 in the wild and no public exploit code.
Other vulnerabilities in Relevanssi Premium
Sources
Also known as GHSA-q3q6-3x37-g8gw.