CVE-2023-3411

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-3411
The Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.0. This is due to missing nonce validation on the ajax_store_save() function. This makes it possible for unauthenticated attackers to modify plugin settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://plugins.trac.wordpress.org/browser/image-map-pro-lite/trunk/image-map-pro-wordpress-lite.php#L410 Exploit
https://www.wordfence.com/threat-intel/vulnerabilities/id/63e108f4-5d9d-4bcf-aef9-aa856f4241ea?source=cve Third Party Advisory
https://plugins.trac.wordpress.org/browser/image-map-pro-lite/trunk/image-map-pro-wordpress-lite.php#L410 Exploit
https://www.wordfence.com/threat-intel/vulnerabilities/id/63e108f4-5d9d-4bcf-aef9-aa856f4241ea?source=cve Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:webcraftplugins:image_map_pro:1.0.0:*:*:*:lite:wordpress:*:*
History

13 Jan 2025, 18:27

Type Values Removed Values Added
CPE cpe:2.3:a:imagemappro:image_map_pro:1.0.0:*:*:*:lite:wordpress:*:* cpe:2.3:a:webcraftplugins:image_map_pro:1.0.0:*:*:*:lite:wordpress:*:*
First Time Webcraftplugins image Map Pro
Webcraftplugins

21 Nov 2024, 08:17

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 4.3 		v2 : unknown
v3 : 6.1
References () https://plugins.trac.wordpress.org/browser/image-map-pro-lite/trunk/image-map-pro-wordpress-lite.php#L410 - Exploit () https://plugins.trac.wordpress.org/browser/image-map-pro-lite/trunk/image-map-pro-wordpress-lite.php#L410 - Exploit
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/63e108f4-5d9d-4bcf-aef9-aa856f4241ea?source=cve - Third Party Advisory () https://www.wordfence.com/threat-intel/vulnerabilities/id/63e108f4-5d9d-4bcf-aef9-aa856f4241ea?source=cve - Third Party Advisory

07 Nov 2023, 04:18

Type Values Removed Values Added
CWE CWE-352

06 Jul 2023, 00:52

Type Values Removed Values Added
References (MISC) https://plugins.trac.wordpress.org/browser/image-map-pro-lite/trunk/image-map-pro-wordpress-lite.php#L410 - (MISC) https://plugins.trac.wordpress.org/browser/image-map-pro-lite/trunk/image-map-pro-wordpress-lite.php#L410 - Exploit
References (MISC) https://www.wordfence.com/threat-intel/vulnerabilities/id/63e108f4-5d9d-4bcf-aef9-aa856f4241ea?source=cve - (MISC) https://www.wordfence.com/threat-intel/vulnerabilities/id/63e108f4-5d9d-4bcf-aef9-aa856f4241ea?source=cve - Third Party Advisory
CVSS v2 : unknown
v3 : 6.1 		v2 : unknown
v3 : 4.3
First Time Imagemappro image Map Pro
Imagemappro
CPE cpe:2.3:a:imagemappro:image_map_pro:1.0.0:*:*:*:lite:wordpress:*:*

27 Jun 2023, 04:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-06-27 04:15

Updated : 2025-01-13 18:27

NVD link : CVE-2023-3411

Mitre link : CVE-2023-3411

CVE.ORG link : CVE-2023-3411

JSON object : View

Products Affected

webcraftplugins

  • image_map_pro
CWE

No CWE.