CVE-2015-2755
published 2015-04-01CVE-2015-2755: Multiple cross-site request forgery (CSRF) vulnerabilities in the AB Google Map Travel (AB-MAP) plugin before 4.0 for WordPress allow remote attackers to…
PriorityP433medium6.8CVSS 2.0
AVNACMAuNCPIPAP
EXPLOIT
EPSS
3.86%
88.9th percentile
Multiple cross-site request forgery (CSRF) vulnerabilities in the AB Google Map Travel (AB-MAP) plugin before 4.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) lat (Latitude), (2) long (Longitude), (3) map_width, (4) map_height, or (5) zoom (Map Zoom) parameter in the ab_map_options page to wp-admin/admin.php.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ab_google_map_travel_project | ab_google_map_travel | <= 3.4 | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Nuclei
WordPress AB Google Map Travel <=3.4 - Stored Cross-Site Scripting
nuclei·CVSS 6.8
CVE-2015-2755 [MEDIUM] WordPress AB Google Map Travel <=3.4 - Stored Cross-Site Scripting
WordPress AB Google Map Travel =3.5) or apply the vendor-supplied patch to mitigate this vulnerability.
reference:
- https://packetstormsecurity.com/files/131155/
- http://packetstormsecurity.com/files/131155/WordPress-Google-Map-Travel-3.4-XSS-CSRF.html
- http://packetstormsecurity.com/files/130960/WordPress-AB-Google-Map-Travel-CSRF-XSS.html
- https://nvd.nist.gov/vuln/detail/https://nvd.nist.gov/vuln/detail/CVE-2015-2755
- https://wordpress.org/plugins/ab-google-map-travel/changelog/
classification:
cvss-metrics: CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P
cvss-score: 6.8
cve-id: CVE-2015-2755
cwe-id: CWE-352
epss-score: 0.00828
epss-percentile: 0.74527
cpe: cpe:2.3:a:ab_google_map_travel_project:ab_google_map_travel:*:*:*:*:*:wordpress:*:*
metadata:
verified: true
max-request: 2
vendor: ab_goo
No writeups or analysis indexed.
http://packetstormsecurity.com/files/130960/WordPress-AB-Google-Map-Travel-CSRF-XSS.htmlhttp://packetstormsecurity.com/files/131155/WordPress-Google-Map-Travel-3.4-XSS-CSRF.htmlhttp://www.securityfocus.com/archive/1/534954/100/0/threadedhttp://www.securityfocus.com/archive/1/535026/100/0/threadedhttp://www.securityfocus.com/bid/71417https://wordpress.org/plugins/ab-google-map-travel/changelog/http://packetstormsecurity.com/files/130960/WordPress-AB-Google-Map-Travel-CSRF-XSS.htmlhttp://packetstormsecurity.com/files/131155/WordPress-Google-Map-Travel-3.4-XSS-CSRF.htmlhttp://www.securityfocus.com/archive/1/534954/100/0/threadedhttp://www.securityfocus.com/archive/1/535026/100/0/threadedhttp://www.securityfocus.com/bid/71417https://wordpress.org/plugins/ab-google-map-travel/changelog/
2015-04-01
Published