CVE-2014-1980: XSS
Published Aug 14, 2014
·Updated
Cross-site scripting (XSS) vulnerability in include/functionsmetadata.inc.php in Piwigo before 2.4.6 allows remote attackers to inject arbitrary web script or HTML via the Make field in IPTC Exif metadata within an image uploaded to the Community plugin.
Affected Software
36 affected components
Piwigo piwigo<=2.4.5
Piwigo piwigo=2.0.0
Piwigo piwigo=2.0.1
Piwigo piwigo=2.0.2
Piwigo piwigo=2.0.3
Piwigo piwigo=2.0.4
Piwigo piwigo=2.0.5
Piwigo piwigo=2.0.6
Piwigo piwigo=2.0.7
Piwigo piwigo=2.0.8
Piwigo piwigo=2.0.9
Piwigo piwigo=2.0.10
Piwigo piwigo=2.1.0
Piwigo piwigo=2.1.1
Piwigo piwigo=2.1.2
Piwigo piwigo=2.1.3
Piwigo piwigo=2.1.4
Piwigo piwigo=2.1.5
Piwigo piwigo=2.1.6
Piwigo piwigo=2.2.0
Piwigo piwigo=2.2.1
Piwigo piwigo=2.2.2
Piwigo piwigo=2.2.3
Piwigo piwigo=2.2.4
Piwigo piwigo=2.2.5
Piwigo piwigo=2.3.0
Piwigo piwigo=2.3.1
Piwigo piwigo=2.3.2
Piwigo piwigo=2.3.3
Piwigo piwigo=2.3.4
Piwigo piwigo=2.3.5
Piwigo piwigo=2.4.0
Piwigo piwigo=2.4.1
Piwigo piwigo=2.4.2
Piwigo piwigo=2.4.3
Piwigo piwigo=2.4.4
Event History
Aug 14, 2014
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-1980?
CVE-2014-1980 is classified as a medium-risk cross-site scripting (XSS) vulnerability.
2
How do I fix CVE-2014-1980?
To fix CVE-2014-1980, upgrade Piwigo to version 2.4.6 or later.
3
Which versions of Piwigo are affected by CVE-2014-1980?
CVE-2014-1980 affects all Piwigo versions prior to 2.4.6, including versions 2.0.0 to 2.4.5.
4
What type of vulnerability is CVE-2014-1980?
CVE-2014-1980 is a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts.
5
Can CVE-2014-1980 be exploited remotely?
Yes, CVE-2014-1980 can be exploited remotely by attackers through the upload of malicious images.