PT-2023-24681 · WordPress · Image Map Pro
Kenichiro Ito
·
Publicado
2023-06-27
·
Atualizado
2025-01-13
·
CVE-2023-3411
CVSS v3.1
6.1
Média
| Vetor | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite plugin for WordPress versions up to, and including, 1.0.0
Description
The issue is due to missing nonce validation on the
ajax store save() function, making it possible for unauthenticated attackers to modify plugin settings and inject malicious web scripts via a forged request. This can be achieved if an attacker can trick a site administrator into performing an action, such as clicking on a link.Recommendations
For versions up to, and including, 1.0.0, consider disabling the
ajax store save() function until a patch is available to prevent exploitation. Restrict access to the plugin's settings to minimize the risk of unauthorized modifications.Exploit
Correção
CSRF
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Image Map Pro