adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-10-31 06:02:00 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

CVE-2018-7722 #786

New Issue
Closed
opened 2026-10-05 00:17:19 +02:00 by adam · 3 comments
adam commented 2026-10-05 00:17:19 +02:00
Owner
Copy link
Copy source

https://nvd.nist.gov/vuln/detail/CVE-2018-7722

The management panel in Piwigo 2.9.3 has stored XSS via the name parameter in
a /ws.php?format=json request. CSRF exploitation, related to CVE-2017-10681,
may be possible.

From discussion with developer:

The best one would be to add a required parameter pwg_token, but it would break
remote apps (like the iOS app) which is more a problem than a solution. So we will
escape any JS in the "name" parameter.

When you fix this vulnerability could you mention CVE in commit message, thank you.

https://nvd.nist.gov/vuln/detail/CVE-2018-7722 > The management panel in Piwigo 2.9.3 has stored XSS via the name parameter in > a /ws.php?format=json request. CSRF exploitation, related to CVE-2017-10681, > may be possible. From discussion with developer: > The best one would be to add a required parameter pwg_token, but it would break > remote apps (like the iOS app) which is more a problem than a solution. So we will > escape any JS in the "name" parameter. When you fix this vulnerability could you mention CVE in commit message, thank you. <!-- github-sync-id:325607029 -->
adam closed this issue 2026-10-05 00:17:19 +02:00
adam commented 2026-10-05 00:17:20 +02:00
Author
Owner
Copy link
Copy source

@plegall can we fix this also in 2.9.4?

@plegall can we fix this also in 2.9.4? <!-- github-comment-id:403066738 -->
adam commented 2026-10-05 00:17:21 +02:00
Author
Owner
Copy link
Copy source

@fgeek yes, it was a bit more complicated to fix, compared to #872

@fgeek yes, it was a bit more complicated to fix, compared to #872 <!-- github-comment-id:403084451 -->
adam commented 2026-10-05 00:17:22 +02:00
Author
Owner
Copy link
Copy source

Great. Thank you for your efforts once again.

Great. Thank you for your efforts once again. <!-- github-comment-id:403088889 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#786