adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-10-30 21:52:00 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

Vulnerability on jQuery 1.11.3 #1648

New Issue
Open
opened 2026-10-05 00:51:29 +02:00 by adam · 3 comments
adam commented 2026-10-05 00:51:29 +02:00
Owner
Copy link
Copy source

Hi,
Since one year my personal galery is accessible on internet via a https server. Certificat done with let's encrypt.
I tested one year about vulnerability, and I tested again today.
some fixes are at my hand, some not. I think the two below are for piwigo team.
-No Anti-CSRF tokens were found in a HTML submission form
-The identified library jquery, version 1.11.3 is vulnerable.

Websites used:
-https://hostedscan.com
-https://securityheaders.com/

I found several issues opens but no answer for some.
Thank you for your attention

Hi, Since one year my personal galery is accessible on internet via a https server. Certificat done with let's encrypt. I tested one year about vulnerability, and I tested again today. some fixes are at my hand, some not. I think the two below are for piwigo team. -No Anti-CSRF tokens were found in a HTML submission form -The identified library jquery, version 1.11.3 is vulnerable. Websites used: -https://hostedscan.com -https://securityheaders.com/ I found several issues opens but no answer for some. Thank you for your attention <!-- github-sync-id:1642024588 -->
adam commented 2026-10-05 00:51:30 +02:00
Author
Owner
Copy link
Copy source

We use an anti-CSRF token, but not on all forms.

There is already an issue about our "vulnerable" jQuery version, see #1021 Still don't know how "vulnerable" it really is.

We use an anti-CSRF token, but not on all forms. There is already an issue about our "vulnerable" jQuery version, see #1021 Still don't know how "vulnerable" it really is. <!-- github-comment-id:1485077121 -->
adam commented 2026-10-05 00:51:31 +02:00
Author
Owner
Copy link
Copy source

Hi,
*ok for anti-CSRF token with time it will come anywhere
*jquery see:
-https://security.snyk.io/package/npm/jquery/1.11.3
-https://www.cybersecurity-help.cz/vdb/jquery/jquery/1.11.3/
even WhatsApp detects and fixes it: https://community.progress.com/s/article/vulnerable-jquery-versions-running-on-whatsup

image

Hi, *ok for anti-CSRF token with time it will come anywhere *jquery see: -https://security.snyk.io/package/npm/jquery/1.11.3 -https://www.cybersecurity-help.cz/vdb/jquery/jquery/1.11.3/ even WhatsApp detects and fixes it: https://community.progress.com/s/article/vulnerable-jquery-versions-running-on-whatsup ![image](https://user-images.githubusercontent.com/64729485/227948818-fd1a126b-c05b-46d0-b129-03c4611dd3b7.png) <!-- github-comment-id:1485084288 -->
adam commented 2026-10-05 00:51:32 +02:00
Author
Owner
Copy link
Copy source

@plegall
more details

image

@plegall more details ![image](https://user-images.githubusercontent.com/64729485/227973507-f1493896-004a-485d-a490-f9e5950144e7.png) <!-- github-comment-id:1485237224 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#1648