QwikSec

Security Database

CVE

CWE

Training

CVE-2021-24947

Published: Feb 7, 2022

Modified: Aug 3, 2024

PUBLISHED

Description

The RVM WordPress plugin before 6.4.2 does not have proper authorisation, CSRF checks and validation of the rvm_upload_regions_file_path parameter in the rvm_import_regions AJAX action, allowing any authenticated user, such as subscriber, to read arbitrary files on the web server

Vendor	Product	Versions
Unknown	RVM – Responsive Vector Maps	affected `6.4.2 - < 6.4.2`

Weaknesses (CWE)

References

https://wpscan.com/vulnerability/c6bb12b1-6961-40bd-9110-edfa9ee41a18

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.