PT-2017-7911 · Piwigo · Piwigo

Plegall · Publicado 2017-10-10 · Atualizado 2017-11-05 · CVE-2016-10514

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 2.8.3

Description The issue allows remote attackers to bypass intended access restrictions. This can be achieved via a URL that contains a " character, or a URL beginning with a substring other than the http:// or https:// substring. The problem is located in the url check format function in include/functions.inc.php.

Recommendations For versions prior to 2.8.3, update to version 2.8.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the url check format function in include/functions.inc.php until a patch is available. Avoid using URLs that contain a " character or start with substrings other than http:// or https:// in the affected function.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2016-10514

Produtos afetados

Piwigo

Referências · 6

• https://github.com/Piwigo/Piwigo/issues/547 · Correção
• https://github.com/Piwigo/Piwigo/commit/b3157cbfd859c914911b114d4edbba4654758b57 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2016-10514 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10514 · Nota
• https://osv.dev/vulnerability/CVE-2016-10514 · Aviso do Fabricante
• http://piwigo.org/releases/2.8.3 · Aviso do Fabricante