PT-2021-19504 · Piwigo · Piwigo Localfileseditor

Harry Goodman · Published 2021-04-26 · Updated 2021-05-04 · CVE-2021-31783

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Piwigo LocalFilesEditor extension versions prior to 11.4.0.1

Description The issue allows for Local File Inclusion due to the lack of proper validation of the file parameter in the show default.php file.

Recommendations For versions prior to 11.4.0.1, update to version 11.4.0.1 or later to resolve the issue.

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2021-31783

Affected Products

Piwigo Localfileseditor

References · 5

• https://github.com/Piwigo/LocalFilesEditor/commit/dda691d3e45bfd166ac175c70bd8b91cb4917b6b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-31783 · Security Note
• https://osv.dev/vulnerability/CVE-2021-31783 · Vendor Advisory
• https://github.com/Piwigo/LocalFilesEditor/issues/2 · Note
• https://piwigo.org/ext/index.php?cid=null · Note