CVE-2021-24947

CVE-2021-24947: RVM - Responsive Vector Maps < 6.4.2 - Subscriber+ Arbitrary File Read

Vendor Unknown

Product RVM – Responsive Vector Maps

Weakness CWE-863 · Incorrect authorization

Published February 7, 2022

Last update August 3, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The RVM WordPress plugin before 6.4.2 does not have proper authorisation, CSRF checks and validation of the rvm_upload_regions_file_path parameter in the rvm_import_regions AJAX action, allowing any authenticated user, such as subscriber, to read arbitrary files on the web server

Key dates

02Disclosure timeline

February 7, 2022 CVE published

August 3, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2021-24947 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/863.html

Related vulnerabilities

04Related CVE

CVE-2022-0633 UpdraftPlus Free < 1.22.3 & Premium < 2.22.3 - Subscriber+ Backup Download CVE-2022-22307 IBM Security Guardium privilege escalation CVE-2024-24773 Apache Superset: Improper validation of SQL statements allows for unauthorized access to data CVE-2026-44573 Next.js: Middleware / Proxy bypass in Pages Router applications using i18n CVE-2026-21274 Dreamweaver Desktop | Incorrect Authorization (CWE-863)