CVE-2021-31783

Опубликовано: 26 апр. 2021

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

show_default.php in the LocalFilesEditor extension before 11.4.0.1 for Piwigo allows Local File Inclusion because the file parameter is not validated with a proper regular-expression check.

Ссылки

https://github.com/Piwigo/LocalFilesEditor/commit/dda691d3e45bfd166ac175c70bd8b91cb4917b6b
Patch
Third Party Advisory
https://github.com/Piwigo/LocalFilesEditor/issues/2
Issue Tracking
Third Party Advisory
https://piwigo.org/ext/index.php?cid=null
Release Notes
Third Party Advisory
https://github.com/Piwigo/LocalFilesEditor/commit/dda691d3e45bfd166ac175c70bd8b91cb4917b6b
Patch
Third Party Advisory
https://github.com/Piwigo/LocalFilesEditor/issues/2
Issue Tracking
Third Party Advisory
https://piwigo.org/ext/index.php?cid=null
Release Notes
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:piwigo:localfiles_editor:*:*:*:*:*:piwigo:*:*

Версия до 11.4.0.1 (исключая)

EPSS

Процентиль: 45%

0.0062

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-345

Связанные уязвимости

GHSA-35gm-xggq-mjxq

github

около 4 лет назад