Cross-Site Scripting in Zenphoto by Zenphoto Foundation
CVE-2012-4519

6.1MEDIUM

Key Information:

Vendor

Zenphoto

Status
Zenphoto
Vendor
CVE Published:
11 February 2020

What is CVE-2012-4519?

A vulnerability in Zenphoto prior to version 1.4.3.4 allows attackers to exploit a Cross-Site Scripting (XSS) flaw through the date parameter in the admin-news-articles.php script. This weakness can potentially enable an attacker to inject malicious scripts into web pages viewed by other users, leading to unauthorized actions and data exposure. It is essential for users to update to the latest version to mitigate the risk associated with this vulnerability.

Affected Version(s)

Zenphoto before 1.4.3.4

References

http://www.openwall.com/lists/oss-security/2012/10/11/10
x_refsource_MISC
http://www.openwall.com/lists/oss-security/2013/07/10/19
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.