PT-2023-24308 · Piwigo · Piwigo

Publicado 2023-05-23 · Atualizado 2023-05-30 · CVE-2023-33359

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Piwigo version 13.6.0

Description The issue concerns Cross Site Request Forgery (CSRF) in the "add tags" function. This means an attacker could potentially trick a user into performing unintended actions on the web application.

Recommendations For Piwigo version 13.6.0, update to a version that includes a fix for the CSRF issue in the "add tags" function, as no specific workaround is provided for this version.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2023-33359

Produtos afetados

Piwigo

Referências · 5

• 🔥 https://github.com/Piwigo/Piwigo/issues/1908 · Exploit
• https://osv.dev/vulnerability/CVE-2023-33359 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-33359 · Nota de Segurança
• https://t.me/cibsecurity/64627 · Publicação no Telegram
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-33359 · Nota