CVE-2021-24947CWE-863

RVM - Responsive Vector Maps < 6.4.2 - Subscriber+ Arbitrary File Read

published February 7, 2022

CVSS
—
EPSS
3%
Percentile
87.5
In the wild
Unconfirmed
What it is

The RVM WordPress plugin before 6.4.2 does not have proper authorisation, CSRF checks and validation of the rvm_upload_regions_file_path parameter in the rvm_import_regions AJAX action, allowing any authenticated user, such as subscriber, to read arbitrary files on the web server

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.03063 · 87.5th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2022-02-07T15:47Z
EPSS history
Timeline
  • 07 FEB 15:47Z
    RVM - Responsive Vector Maps < 6.4.2 - Subscriber+ Arbitrary File Read
    cvelistv5