Cross-Site Request Forgery Vulnerability in MapSVG Lite by MapSVG
CVE-2019-1000003

8.8HIGH

Key Information:

Vendor

Wordpress
Status
Mapsvg Lite
Vendor
CVE Published:
4 February 2019

What is CVE-2019-1000003?

MapSVG Lite version 3.2.3 is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability affecting the /wp-admin/admin-ajax.php?action=mapsvg_save endpoint. This security flaw allows an attacker to manipulate post data, including the potential to embed malicious JavaScript, provided that the victim is logged in as an admin and clicks on a specially crafted link. The vulnerability has been addressed in version 3.3.0 and subsequent updates, making it imperative for users to upgrade to protect their WordPress sites from exploitation.

References

https://advisories.dxw.com/advisories/csrf-mapsvg-lite/
x_refsource_MISC
https://wpvulndb.com/vulnerabilities/9198
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.