Community plugin 2.9.e-beta for Piwigo allows users to set image information on images in albums for which they do not have permission,

March 27, 2020

Overview :

The Community plugin 2.9.e-beta for Piwigo allows users to set image information on images in albums for which they do not have permission, by manipulating the image_id parameter.

CVE-2020-9468

security] ability to by-pass protection on photo edition #49

CVE-2020-9468 reported by Zak S.

Further, a malicious user can modify the value of the ‘image_id’ parameter to any existing image id. There are no access controls to prevent a user from manipulating information on images that are in albums to which they do not have access.

References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://github.com/plegall/Piwigo-community/issues/49 MISC:https://piwigo.org/ext/extension_view.php?eid=303

Advanced Machine Learning Based Web Security Solution

The Prophaze WAF can be deployed in any Public cloud such as AWS, GCP, Azure, Digital Ocean and on Private Cloud instance like Microk8s

100%

The security of your details is important to us. Prophaze Technologies collects a variety of data that you provide directly to us. The types of data we gather will depend upon the services you use, how you use them, and what you choose to provide. We process your details when necessary to provide you with the services that you have requested when accepting our Terms of Services or when we have the legitimate interest(security, testing, analytics, and so on) to do so please checkout our page.

Demo Request Form

100% Advanced Machine Learning Based Bot Management Solution

Demo Request Form

Prophaze Free WAF + CDN + DDoS Protection

All in One Web Security Platform

Are you under attack?

The Prophaze WAF can be deployed in any Public cloud such as AWS, GCP, Azure, Digital Ocean and on Private Cloud instance like Microk8s

Attack Protection Hotline

Get emergency help 24x7

Are you under attack?

The Prophaze WAF can be deployed in any Public cloud such as AWS, GCP, Azure, Digital Ocean and on Private Cloud instance like Microk8s

Attack Protection Hotline

Get emergency help 24x7