CVE-2019-20891: CSRF
WooCommerce before 3.6.5, when it handles CSV imports of products, has a cross-site request forgery (CSRF) issue with resultant stored cross-site scripting (XSS) via includes/admin/importers/class-wc-product-csv-importer-controller.php.
Other sources
WooCommerce before 3.6.5, when it handles CSV imports of products, has a cross-site request forgery (CSRF) issue with resultant stored cross-site scripting (XSS) via includes/admin/importers/class-wc-product-csv-importer-controller.php.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-20891?
CVE-2019-20891 is a vulnerability in WooCommerce before version 3.6.5 that allows for cross-site request forgery (CSRF) and resultant stored cross-site scripting (XSS) via CSV imports of products.
What is the severity of CVE-2019-20891?
The severity of CVE-2019-20891 is rated as high, with a severity value of 8.8.
How does CVE-2019-20891 affect WooCommerce?
CVE-2019-20891 affects WooCommerce before version 3.6.5 when it handles CSV imports of products, allowing for CSRF attacks and stored XSS.
Where can I find more information about CVE-2019-20891?
You can find more information about CVE-2019-20891 on the following references: [1] https://blog.ripstech.com/2019/woocommerce-csrf-to-stored-xss/ [2] https://raw.githubusercontent.com/woocommerce/woocommerce/master/CHANGELOG.txt
How can I fix CVE-2019-20891?
To fix CVE-2019-20891, ensure that you have updated WooCommerce to version 3.6.5 or newer, which includes a patch for the vulnerability.