PT-2017-11431 · Piwigo · Piwigo

Flop25 · Publicado 2017-06-29 · Atualizado 2017-07-06 · CVE-2017-10679

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 2.9.2

Description The issue allows remote attackers to obtain sensitive information about the descriptive name of a permalink by examining the redirect URL returned in a request for the permalink ID number of a private album. The permalink ID numbers can be easily guessed.

Recommendations For versions prior to 2.9.2, update to version 2.9.2 or later to resolve the issue.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2017-10679

Produtos afetados

Piwigo

Referências · 6

• 🔥 https://github.com/Piwigo/Piwigo/issues/721 · Exploit
• https://github.com/Piwigo/Piwigo/issues/723 · Correção
• http://securityfocus.com/bid/99380 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10679 · Nota
• https://osv.dev/vulnerability/CVE-2017-10679 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-10679 · Nota de Segurança