PT-2024-36140 · 10Web · The Photo Gallery

Kun_19 + 1 · Published 2024-06-07 · Updated 2024-06-11 · CVE-2024-5426

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress versions up to, and including, 1.8.23

Description: The issue is related to Stored Cross-Site Scripting via the svg parameter due to insufficient input sanitization and output escaping. This allows authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, exploitation is limited to administrators, but contributors on pro versions of the plugin may also be able to exploit this issue if they have been granted the ability to use and configure Photo Gallery.

Recommendations: For versions up to, and including, 1.8.23, update to a version later than 1.8.23 to resolve the issue. As a temporary workaround, consider restricting access to the svg parameter to minimize the risk of exploitation. Additionally, limiting the ability to use and configure Photo Gallery to only trusted administrators can help reduce the attack surface.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-5426

Affected Products

The Photo Gallery

References · 8

• https://osv.dev/vulnerability/CVE-2024-5426 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-5426 · Security Note
• https://plugins.trac.wordpress.org/changeset/3098798 · Patch
• https://t.me/cvenotify/82884 · Telegram Post
• https://plugins.trac.wordpress.org/browser/photo-gallery/trunk/filemanager/UploadHandler.php#L521 · Note
• https://t.me/cvenotify/82267 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/13436238-f14a-445b-9a9b-fbcf23b7b498?source=cve · Note
• https://plugins.trac.wordpress.org/browser/photo-gallery/trunk/filemanager/UploadHandler.php#L542 · Note