Stored Cross-Site Scripting Vulnerability in Zenphoto by Zenphoto
CVE-2022-44449

4.8MEDIUM

Key Information:

Vendor

Zenphoto

Status
Zenphoto
Vendor
CVE Published:
21 December 2022

What is CVE-2022-44449?

A stored cross-site scripting vulnerability exists in Zenphoto versions earlier than 1.6. This flaw permits a remote authenticated attacker with administrative privileges to inject arbitrary scripts into the web application. If exploited, this vulnerability can lead to unauthorized actions being performed on behalf of other users, compromising the security of the application and its users. It is vital for administrators to upgrade to the latest version to mitigate this risk.

Affected Version(s)

Zenphoto versions prior to 1.6

References

https://www.zenphoto.org/
https://github.com/zenphoto/zenphoto
https://jvn.jp/en/jp/JVN06093462/index.html

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.