CVE-2017-20099: analytics_stats_counter_statistics_project analytics_stats_counter_statistics Code Injection

Vulnerability summary

CVE-2017-20099 is a critical (CVSS 9.8) Code Injection vulnerability in analytics_stats_counter_statistics_project analytics_stats_counter_statistics. EPSS estimates a 1.17% chance of exploitation in the next 30 days, higher than 67% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 27-06-2022
   PublishedVulnerability first disclosed.
2. 15-04-2025
   Last modifiedVulnerability information updated.

Description

A vulnerability was found in Analytics Stats Counter Statistics Plugin 1.2.2.5 and classified as critical. This issue affects some unknown processing. The manipulation leads to code injection. The attack may be initiated remotely.

• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.