{"api_version":"1","generated_at":"2026-04-26T08:01:49+00:00","cve":"CVE-2017-20099","urls":{"html":"https://cve.report/CVE-2017-20099","api":"https://cve.report/api/cve/CVE-2017-20099.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2017-20099","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2017-20099"},"summary":{"title":"CVE-2017-20099","description":"A vulnerability was found in Analytics Stats Counter Statistics Plugin 1.2.2.5 and classified as critical. This issue affects some unknown processing. The manipulation leads to code injection. The attack may be initiated remotely.","state":"PUBLIC","assigner":"cna@vuldb.com","published_at":"2022-06-27 19:15:00","updated_at":"2022-07-06 20:40:00"},"problem_types":["CWE-94"],"metrics":[],"references":[{"url":"http://seclists.org/fulldisclosure/2017/Feb/74","name":"http://seclists.org/fulldisclosure/2017/Feb/74","refsource":"MISC","tags":[],"title":"Full Disclosure: Analytics Stats Counter Statistics WordPress Plugin unauthenticated PHP Object injection vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://vuldb.com/?id.97367","name":"https://vuldb.com/?id.97367","refsource":"MISC","tags":[],"title":"CVE-2017-20099 | Analytics Stats Counter Statistics Plugin code injection","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-20099","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-20099","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2017","cve_id":"20099","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"analytics_stats_counter_statistics_project","cpe5":"analytics_stats_counter_statistics","cpe6":"1.2.2.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"data_type":"CVE","data_format":"MITRE","data_version":"4.0","CVE_data_meta":{"ID":"CVE-2017-20099","TITLE":"Analytics Stats Counter Statistics Plugin code injection","REQUESTER":"cna@vuldb.com","ASSIGNER":"cna@vuldb.com","STATE":"PUBLIC"},"generator":"vuldb.com","affects":{"vendor":{"vendor_data":[{"vendor_name":"","product":{"product_data":[{"product_name":"Analytics Stats Counter Statistics Plugin","version":{"version_data":[{"version_value":"1.2.2.5"}]}}]}}]}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-94 Code Injection"}]}]},"description":{"description_data":[{"lang":"eng","value":"A vulnerability was found in Analytics Stats Counter Statistics Plugin 1.2.2.5 and classified as critical. This issue affects some unknown processing. The manipulation leads to code injection. The attack may be initiated remotely."}]},"credit":"Yorick Koster","impact":{"cvss":{"version":"3.1","baseScore":"7.3","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"}},"references":{"reference_data":[{"url":"http://seclists.org/fulldisclosure/2017/Feb/74","refsource":"MISC","name":"http://seclists.org/fulldisclosure/2017/Feb/74"},{"url":"https://vuldb.com/?id.97367","refsource":"MISC","name":"https://vuldb.com/?id.97367"}]}},"nvd":{"publishedDate":"2022-06-27 19:15:00","lastModifiedDate":"2022-07-06 20:40:00","problem_types":["CWE-94"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"},"exploitabilityScore":3.9,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":7.5},"severity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:analytics_stats_counter_statistics_project:analytics_stats_counter_statistics:1.2.2.5:*:*:*:*:wordpress:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":null,"notes":[]}}}