CVE-2022-21241

high-risk
Published 2022-02-08

Cross-site scripting vulnerability in CSV+ prior to 0.8.1 allows a remote unauthenticated attacker to inject an arbitrary script or an arbitrary OS command via a specially crafted CSV file that contains HTML a tag.

Do I need to act?

!
30.0% chance of exploitation in next 30 days
EPSS score — higher than 70% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.6/10 Critical
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Csv\+ Project

References (4)

Release Notes https://github.com/plusone-masaki/csv-plus/releases/tag/v0.8.1
Third Party Advisory https://jvn.jp/en/jp/JVN67396225/index.html
Release Notes https://github.com/plusone-masaki/csv-plus/releases/tag/v0.8.1
Third Party Advisory https://jvn.jp/en/jp/JVN67396225/index.html
52
/ 100
high-risk
Severity 32/34 · Critical
Exploitability 15/34 · Moderate
Exposure 5/34 · Minimal