Join our followers
Multiple Vulnerabilities in ZENphoto
| Advisory ID: | HTB22945 |
| Product: | ZENphoto |
| Vendor: | ZENphoto |
| Vulnerable Versions: | 1.4.0.3. Prior and later versions may be also affected |
| Tested Version: | 1.4.0.3 |
| Advisory Publication: | April 7, 2011 [without technical details] |
| Vendor Notification: | April 7, 2011 |
| Public Disclosure: | April 21, 2011 |
| Latest Update: | January 23, 2012 |
| Vulnerability Type: | Cross-Site Scripting [CWE-79] Information Exposure Through Externally-generated Error Message [CWE-211] |
| Risk Level: | Medium |
 | |
| CVSSv2 Base Scores: | 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N) 5 (AV:N/AC:L/Au:N/C:P/I:N/A:N) |
| Solution Status: | Fixed by Vendor |
| Discovered and Provided: | High-Tech Bridge Security Research Lab |
| Advisory Details: | |
High-Tech Bridge SA Security Research Lab has discovered vulnerabilities in ZENphoto which could be exploited to perform cross-site scripting attacks and disclose potentially sensitive information. | |
| Solution: | |
| Upgrade to the most recent version. Issue 1) is fixed by Vendor by additional security check for PHP configuration during the product Installation process. Issue 2) is fixed by Vendor. | |
References: | |
| [1] High-Tech Bridge Advisory HTB22945 - https://www.immuniweb.com/advisory/HTB22945 - Multiple Vulnerabilities in ZENphoto [2] ZENphoto - www.zenphoto.org - Zenphoto is a standalone CMS for multimedia focused websites. [3] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types. | |
Please feel free to send us any additional information related to this Advisory, such as vulnerable versions, additional exploitation details and conditions, patches and other relevant details.
