CVE-2014-1980: XSS
First published: Thu Aug 14 2014(Updated: )
Cross-site scripting (XSS) vulnerability in include/functions_metadata.inc.php in Piwigo before 2.4.6 allows remote attackers to inject arbitrary web script or HTML via the Make field in IPTC Exif metadata within an image uploaded to the Community plugin.
Credit: vultures@jpcert.or.jp
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Piwigo | <=2.4.5 | |
| Piwigo | =2.0.0 | |
| Piwigo | =2.0.1 | |
| Piwigo | =2.0.2 | |
| Piwigo | =2.0.3 | |
| Piwigo | =2.0.4 | |
| Piwigo | =2.0.5 | |
| Piwigo | =2.0.6 | |
| Piwigo | =2.0.7 | |
| Piwigo | =2.0.8 | |
| Piwigo | =2.0.9 | |
| Piwigo | =2.0.10 | |
| Piwigo | =2.1.0 | |
| Piwigo | =2.1.1 | |
| Piwigo | =2.1.2 | |
| Piwigo | =2.1.3 | |
| Piwigo | =2.1.4 | |
| Piwigo | =2.1.5 | |
| Piwigo | =2.1.6 | |
| Piwigo | =2.2.0 | |
| Piwigo | =2.2.1 | |
| Piwigo | =2.2.2 | |
| Piwigo | =2.2.3 | |
| Piwigo | =2.2.4 | |
| Piwigo | =2.2.5 | |
| Piwigo | =2.3.0 | |
| Piwigo | =2.3.1 | |
| Piwigo | =2.3.2 | |
| Piwigo | =2.3.3 | |
| Piwigo | =2.3.4 | |
| Piwigo | =2.3.5 | |
| Piwigo | =2.4.0 | |
| Piwigo | =2.4.1 | |
| Piwigo | =2.4.2 | |
| Piwigo | =2.4.3 | |
| Piwigo | =2.4.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2014-1980?
CVE-2014-1980 is classified as a medium-risk cross-site scripting (XSS) vulnerability.
How do I fix CVE-2014-1980?
To fix CVE-2014-1980, upgrade Piwigo to version 2.4.6 or later.
Which versions of Piwigo are affected by CVE-2014-1980?
CVE-2014-1980 affects all Piwigo versions prior to 2.4.6, including versions 2.0.0 to 2.4.5.
What type of vulnerability is CVE-2014-1980?
CVE-2014-1980 is a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts.
Can CVE-2014-1980 be exploited remotely?
Yes, CVE-2014-1980 can be exploited remotely by attackers through the upload of malicious images.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/references
- agent/last-modified-date
- agent/weakness
- agent/author
- agent/first-publish-date
- agent/description
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/piwigo
- canonical/piwigo
- version/piwigo/2.4.5
- version/piwigo/2.0.0
- version/piwigo/2.0.1
- version/piwigo/2.0.2
- version/piwigo/2.0.3
- version/piwigo/2.0.4
- version/piwigo/2.0.5
- version/piwigo/2.0.6
- version/piwigo/2.0.7
- version/piwigo/2.0.8
- version/piwigo/2.0.9
- version/piwigo/2.0.10
- version/piwigo/2.1.0
- version/piwigo/2.1.1
- version/piwigo/2.1.2
- version/piwigo/2.1.3
- version/piwigo/2.1.4
- version/piwigo/2.1.5
- version/piwigo/2.1.6
- version/piwigo/2.2.0
- version/piwigo/2.2.1
- version/piwigo/2.2.2
- version/piwigo/2.2.3
- version/piwigo/2.2.4
- version/piwigo/2.2.5
- version/piwigo/2.3.0
- version/piwigo/2.3.1
- version/piwigo/2.3.2
- version/piwigo/2.3.3
- version/piwigo/2.3.4
- version/piwigo/2.3.5
- version/piwigo/2.4.0
- version/piwigo/2.4.1
- version/piwigo/2.4.2
- version/piwigo/2.4.3
- version/piwigo/2.4.4