Vulnerability Description
The Leaflet Map WordPress plugin before 3.0.0 does not verify the CSRF nonce when saving its settings, which allows attackers to make a logged in admin update the settings via a Cross-Site Request Forgery attack. This could lead to Cross-Site Scripting issues by either changing the URL of the JavaScript library being used, or using malicious attributions which will be executed in all page with an embed map from the plugin
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Leaflet Map Project | Leaflet Map | < 3.0.0 |
Related Weaknesses (CWE)
References
- https://wpscan.com/vulnerability/ac32d265-066e-49ec-9042-3145cd99e2e8ExploitThird Party Advisory
- https://wpscan.com/vulnerability/ac32d265-066e-49ec-9042-3145cd99e2e8ExploitThird Party Advisory
FAQ
What is CVE-2021-24467?
CVE-2021-24467 is a vulnerability with a CVSS score of 6.5 (MEDIUM). The Leaflet Map WordPress plugin before 3.0.0 does not verify the CSRF nonce when saving its settings, which allows attackers to make a logged in admin update the settings via a Cross-Site Request For...
How severe is CVE-2021-24467?
CVE-2021-24467 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-24467?
Check the references section above for vendor advisories and patch information. Affected products include: Leaflet Map Project Leaflet Map.