CVE-2021-24467CWE-352CWE-79

Leaflet Map < 3.0.0 - Arbitrary Settings Update via CSRF Leading to Stored XSS

published August 9, 2021

CVSS
—
EPSS
1%
Percentile
45.9
In the wild
Unconfirmed
What it is

The Leaflet Map WordPress plugin before 3.0.0 does not verify the CSRF nonce when saving its settings, which allows attackers to make a logged in admin update the settings via a Cross-Site Request Forgery attack. This could lead to Cross-Site Scripting issues by either changing the URL of the JavaScript library being used, or using malicious attributions which will be executed in all page with an embed map from the plugin

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00560 · 45.9th percentile
Weaknesses
CWE-352 · Cross-Site Request Forgery (CSRF); CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-08-09T10:04Z
EPSS history
Timeline
  • 09 AUG 10:04Z
    Leaflet Map < 3.0.0 - Arbitrary Settings Update via CSRF Leading to Stored XSS
    cvelistv5