Is CVE-2017-5608 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2017-5608 being exploited in the wild.

How severe is CVE-2017-5608?

Medium severity, with a CVSS score of 6.1, published 28 January 2017.

Is there a fix for CVE-2017-5608?

A patch was published on 2017-01-27: Version 2.8.6 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2017-5608 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2017-5608?

Check whether you run Piwigo. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2017-5608: Piwigo XSS in image upload filename

CVE-2017-5608 · Severity: medium · CVSS 6.1 · Published 2017-01-28

Piwigo, an open-source photo gallery software, is vulnerable to a security flaw in its image upload system. An attacker can upload a file with a specially crafted name containing malicious code. If an administrator or another user views the uploaded image, that code could execute in their browser, potentially leading to unauthorized actions or data theft.

Technologies: Piwigo. Vendors: Piwigo.

Quick answers

Is CVE-2017-5608 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2017-5608 being exploited in the wild.
How severe is CVE-2017-5608?: Medium severity, with a CVSS score of 6.1, published 28 January 2017.
Which products and versions are affected?: Piwigo Piwigo < 2.8.6.
Is there a fix for CVE-2017-5608?: A patch was published on 2017-01-27: Version 2.8.6 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2017-5608 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2017-5608?: Check whether you run Piwigo. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in Piwigo's image upload functionality (specifically via the pwg.images.upload method in ws.php). The application fails to properly sanitize the filename of uploaded images before displaying them in the web interface. An attacker can exploit this by uploading an image with a filename containing HTML or JavaScript payloads. When a user or administrator views the image or its associated metadata, the payload executes in the context of their session. This can lead to session hijacking or unauthorized administrative actions. The issue is fixed in version 2.8.6 by implementing better input handling for uploaded filenames.

Affected products

Piwigo Piwigo < 2.8.6

Timeline

2017-01-04: disclosed: Issue reported on GitHub
2017-01-27: patched: Version 2.8.6 released
2017-01-28: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.