Published:2020/06/11  Last Updated:2020/06/11

JVN#32252648
Multiple vulnerabilities in Zenphoto

Overview

Zenphoto contains multiple vulnerabilities.

Products Affected

  • Zenphoto versions prior to 1.5.7

Description

Zenphoto is a content management system (CMS).  Zenphoto contains multiple vulnerabilities listed below.

  • Cross-site Scripting (CWE-79) - CVE-2020-5592
    CVSS v3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Base Score: 6.1
    CVSS v2 AV:N/AC:M/Au:N/C:N/I:P/A:N Base Score: 4.3
  • Code Injection (CWE-94) - CVE-2020-5593
    CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Base Score: 8.8
    CVSS v2 AV:N/AC:L/Au:S/C:P/I:P/A:P Base Score: 6.5

Impact

  • Arbitrary JavaScript may be executed on the user's web browser - CVE-2020-5592
  • Arbitrary PHP code may be executed on the server where the product is running if a specialy crafted .zip file by an attacker is uploaded - CVE-2020-5593

Solution

Update the software
Update the software to the latest version according to the information provided by the developer.

Vendor Status

Vendor Link
Zenphoto Zenphoto 1.5.7 (Jun 04, 2020)

References

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

Credit

Tomohisa Maeda of Panasonic Corporation, Product Security Center reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE CVE-2020-5592
CVE-2020-5593
JVN iPedia JVNDB-2020-000038

Update History

2020/06/11
Fixed the typo under the section [Description] and [Impact]