PT-2017-14622 · Piwigo · Piwigo

Xcold · Publicado 2017-12-01 · Atualizado 2017-12-19 · CVE-2017-16893

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 2.9.3

Description The issue allows remote authenticated attackers to obtain information in the context of the user used by the application to retrieve data from the database. The "tags.php" endpoint is affected, specifically the edit list parameter, which is not sanitized and is used to construct an SQL query to retrieve a list of registered users into the application.

Recommendations For Piwigo version 2.9.2 and possibly prior, update to a version that contains a fix for this issue to prevent exploitation. As a temporary workaround, consider restricting access to the "tags.php" endpoint or sanitizing the edit list parameter to minimize the risk of exploitation.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2017-16893

Produtos afetados

Piwigo

Referências · 4

• https://github.com/Piwigo/Piwigo/issues/804 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-16893 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-16893 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16893 · Nota