Cross Site Scripting in Piwigo Admin Tools Plugin
CVE-2023-51790

6.1MEDIUM

Key Information:

Vendor

Piwigo

Status
Piwigo
Vendor
CVE Published:
12 January 2024

What is CVE-2023-51790?

A cross site scripting vulnerability exists in the Admin Tools component of Piwigo version 14.0.0. This flaw allows a remote attacker to inject malicious scripts by manipulating the 'lang' parameter. If successfully exploited, it could enable the attacker to access sensitive information, posing significant risks to affected users and potentially compromising the integrity of the system.

References

https://github.com/Piwigo/Piwigo/issues/2069
https://github.com/Piwigo/AdminTools/issues/21

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.