Stored Cross-Site Scripting Vulnerability in Piwigo by Piwigo
CVE-2022-48007

5.4MEDIUM

Key Information:

Vendor

Piwigo

Status
Piwigo
Vendor
CVE Published:
27 January 2023

What is CVE-2022-48007?

A stored cross-site scripting vulnerability exists in Piwigo v13.4.0, specifically within the identification.php file. This flaw enables attackers to inject arbitrary web scripts or HTML into the User-Agent field. If successfully exploited, it can lead to unauthorized actions performed on behalf of users, potentially compromising user accounts and allowing attackers to manipulate content or gain sensitive information.

References

https://github.com/Piwigo/Piwigo/issues/1835

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.