Photoswipe Responsive Javascript Modal Image Gallery
Monthly
Missing authorization in the Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery contributed module (all versions from 0.0.0 up to and including 3.2.0) lets unauthenticated remote users reach gallery resources they should not be able to see by directly requesting their URLs (forceful browsing). Because the module fails to enforce access control on protected content, an attacker can enumerate and retrieve images or associated data intended for privileged users only. No public exploit identified at time of analysis, and EPSS is low (0.13%), but the flaw is trivially automatable per CISA SSVC.
Stored cross-site scripting in the Drupal contributed module PhotoSwipe - Responsive JavaScript Modal Image Gallery (versions below 5.0.9) lets a user who can create or edit content handled by the module persist an unsanitized payload that executes in the browser of another user who later views the affected page. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N, base 4.6) confirms an authenticated content contributor is required and that a second user must interact with the page, with impact limited to partial confidentiality and integrity inside the victim's session and no availability effect. No public exploit code is identified at time of analysis and CISA SSVC records exploitation as none and not automatable, with EPSS at 0.16% (5th percentile); the vendor has released a fix in 5.0.9, so exposure is removed by updating.
Missing authorization in the Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery contributed module (all versions from 0.0.0 up to and including 3.2.0) lets unauthenticated remote users reach gallery resources they should not be able to see by directly requesting their URLs (forceful browsing). Because the module fails to enforce access control on protected content, an attacker can enumerate and retrieve images or associated data intended for privileged users only. No public exploit identified at time of analysis, and EPSS is low (0.13%), but the flaw is trivially automatable per CISA SSVC.
Stored cross-site scripting in the Drupal contributed module PhotoSwipe - Responsive JavaScript Modal Image Gallery (versions below 5.0.9) lets a user who can create or edit content handled by the module persist an unsanitized payload that executes in the browser of another user who later views the affected page. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N, base 4.6) confirms an authenticated content contributor is required and that a second user must interact with the page, with impact limited to partial confidentiality and integrity inside the victim's session and no availability effect. No public exploit code is identified at time of analysis and CISA SSVC records exploitation as none and not automatable, with EPSS at 0.16% (5th percentile); the vendor has released a fix in 5.0.9, so exposure is removed by updating.