adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-10-30 21:52:00 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

CVE-2018-5692 #764

New Issue
Closed
opened 2026-10-05 00:16:09 +02:00 by adam · 3 comments
adam commented 2026-10-05 00:16:09 +02:00
Owner
Copy link
Copy source

https://nvd.nist.gov/vuln/detail/CVE-2018-5692

Piwigo v2.8.2 has XSS via the tab, to, section, mode, installstatus,
and display parameters of the admin.php file.

CVE has reference https://www.vulnerability-lab.com/get_content.php?id=2005 which actually lists versions 2.8.2, 2.9.1 and 2.9.2 as vulnerable. Could you tell me versions and commits that fixes this issue, thank you?

https://nvd.nist.gov/vuln/detail/CVE-2018-5692 > Piwigo v2.8.2 has XSS via the `tab`, `to`, `section`, `mode`, `installstatus`, > and `display` parameters of the `admin.php` file. CVE has reference https://www.vulnerability-lab.com/get_content.php?id=2005 which actually lists versions 2.8.2, 2.9.1 and 2.9.2 as vulnerable. Could you tell me versions and commits that fixes this issue, thank you? <!-- github-sync-id:302070336 -->
adam closed this issue 2026-10-05 00:16:09 +02:00
adam commented 2026-10-05 00:16:11 +02:00
Author
Owner
Copy link
Copy source

Good question. In the future, browse to the file with the problem and click "History". You can see all changed to the file.

It appears admin.php XSS tab was attempted to be fixed in 3ae62ce118 and page in 4310fe7a55

Good question. In the future, browse to the file with the problem and click "History". You can see all changed to the file. It appears admin.php XSS `tab` was attempted to be fixed in 3ae62ce1187d395dac0732c40b8faf6e39312c25 and `page` in 4310fe7a55006d00d404c57c5ce09140e43548a2 <!-- github-comment-id:386431588 -->
adam commented 2026-10-05 00:16:11 +02:00
Author
Owner
Copy link
Copy source

@TallGuysFreeADMIN I asked this in issue tracker, because I wanted to get information from the developers. It's easy to say that commit x fixed something, but it leaves me unsure if the whole case is fixed. Also in some cases vendors don't create new releases to fix vulnerabilities even they should (not in Piwigo's case). I want to notify Piwigo users after all fixes to update to version x so that they are secure. Thank you for your help to get clarity to this case. Not saying anything bad about specific researchers, but vulnerability-lab.com sometimes has pretty confusing advisories without needed details.

I have suggested page per CVE type of informational web pages, but it will probably take some time to get those done if the idea is even approved by devs :)

@TallGuysFreeADMIN I asked this in issue tracker, because I wanted to get information from the developers. It's easy to say that commit x fixed something, but it leaves me unsure if the whole case is fixed. Also in some cases vendors don't create new releases to fix vulnerabilities even they should (not in Piwigo's case). I want to notify Piwigo users after all fixes to update to version x so that they are secure. Thank you for your help to get clarity to this case. Not saying anything bad about specific researchers, but vulnerability-lab.com sometimes has pretty confusing advisories without needed details. I have suggested page per CVE type of informational web pages, but it will probably take some time to get those done if the idea is even approved by devs :) <!-- github-comment-id:391056249 -->
adam commented 2026-10-05 00:16:12 +02:00
Author
Owner
Copy link
Copy source

@plegall is this already fixed with these two commits? I can try to reproduce this issue in master if that is needed, but I try to avoid creating PRs as I'm not that familiar with the codebase.

What do you think about creating security pages per CVE? Similar to https://www.phpmyadmin.net/security/PMASA-2018-4/

@plegall is this already fixed with these two commits? I can try to reproduce this issue in master if that is needed, but I try to avoid creating PRs as I'm not that familiar with the codebase. What do you think about creating security pages per CVE? Similar to https://www.phpmyadmin.net/security/PMASA-2018-4/ <!-- github-comment-id:403149990 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#764