PT-2020-20680
CVE-2020-9467
·
Published
2020-03-26
·
Updated
2022-05-24
Description by
CVSS 3.1
5.4
MediumMetricsAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
Piwigo version 2.10.1
Description
The issue is related to stored XSS via the
file parameter in a "/ws.php" request. This is caused by the pwg.images.setInfo function.Recommendations
For Piwigo version 2.10.1, consider disabling the
pwg.images.setInfo function as a temporary workaround until a patch is available. Restrict access to the "/ws.php" endpoint to minimize the risk of exploitation. Avoid using the file parameter in the affected API endpoint until the issue is resolved.Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾