CVE-2019-1000003
Summary
| CVE | CVE-2019-1000003 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2019-02-04 21:29:00 UTC |
| Updated | 2019-02-15 19:40:00 UTC |
| Description | MapSVG MapSVG Lite version 3.2.3 contains a Cross Site Request Forgery (CSRF) vulnerability in REST endpoint /wp-admin/admin-ajax.php?action=mapsvg_save that can result in an attacker can modify post data, including embedding javascript. This attack appears to be exploitable via the victim must be logged in to WordPress as an admin, and click a link. This vulnerability appears to have been fixed in 3.3.0 and later. |
Risk And Classification
Problem Types: CWE-352
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Mapsvg | Mapsvg Lite | 3.2.3 | All | All | All |
| Application | Mapsvg | Mapsvg Lite | 3.2.3 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| CSRF in MapSVG Lite could allow an attacker to do almost anything an admin can – dxw advisories | MISC | advisories.dxw.com | Third Party Advisory |
| MapSVG Lite <= 3.2.3 - Cross-Site Request Forgery (CSRF) | MISC | wpvulndb.com | Exploit, Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.