SecPod SCAP Repo, a repository of SCAP Content (CVE, CCE, CPE, CWE, OVAL and XCCDF)

Download | Alert*

CVE

CVE-2015-2034

Cross-site scripting (XSS) vulnerability in the administrative backend in Piwigo before 2.7.4 allows remote attackers to inject arbitrary web script or HTML via the page parameter to admin.php.

CVSS Score and Metrics +CVSS Score and Metrics -

CVSS V2 Severity:
CVSS Score : 4.3
Exploit Score: 8.6
Impact Score: 2.9

CVSS V2 Metrics:
Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality: NONE
Integrity: PARTIAL
Availability: NONE

Reference:

http://seclists.org/fulldisclosure/2015/Feb/73

BID-72690

http://packetstormsecurity.com/files/130432/CMS-Piwigo-2.7.3-Cross-Site-Scripting-SQL-Injection.html

http://piwigo.org/forum/viewtopic.php?id=25179

http://piwigo.org/releases/2.7.4

http://sroesemann.blogspot.de/2015/01/sroeadv-2015-06.html

http://sroesemann.blogspot.de/2015/02/report-for-advisory-sroeadv-2015-06.html


30479



423868



248038



909



194772



282