Description

The Batch Manager component of Piwigo 2.9.2 is vulnerable to Persistent Cross Site Scripting via tags-* array parameters in an admin.php?page=batch_manager&mode=unit request. An attacker can exploit this to hijack a client's browser along with the data stored in it.

Remediation

References

CVE-2017-17825

Related Vulnerabilities

Oracle JRE CVE-2014-0459 Vulnerability (CVE-2014-0459)

WordPress Plugin WooCommerce Product Feed for Google, Facebook, eBay and Many More Cross-Site Request Forgery (1.5.26)

WordPress Plugin Hungred Post Thumbnail 'hpt_file_upload.php' Arbitrary File Upload (2.1.9)

Apache HTTP Server Other Vulnerability (CVE-2003-0987)

WordPress Plugin Music Store Unspecified Vulnerability (1.0.20)

Severity

Medium

Classification

CVE-2017-17825 CWE-707 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities