PT-2026-21769 · Piwigo · Piwigo

CVE-2024-48928 · Publicado 2026-02-24 · Atualizado 2026-02-25

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Piwigo versions 14.x

Description Piwigo is a photo gallery application for the web. In versions on the 14.x branch, the secret key configuration parameter is set to MD5(RAND()) during installation when using MySQL. The RAND() function has limited randomness (30 bits), allowing the secret key to be brute-forced in approximately one hour. The CSRF token is partially constructed from the secret key, enabling verification of a successful brute-force attempt. The auto login key utilizes the user's password in addition to the secret key, and the pwg token incorporates the user's session identifier along with the secret key. Knowing the secret key allows the generation of values for get ephemeral key.

Recommendations Update to version 15.0.0 or later.

Exploit

Correção

Use of Insufficiently Random Values

Enumeração de Fraquezas

CWE-330

Identificadores relacionados

CVE-2024-48928

GHSA-HGHG-37RG-7R42

Produtos afetados

Piwigo

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/48xxx/CVE-2024-48928.json · Exploit
• https://github.com/Piwigo/Piwigo/security/advisories/GHSA-hghg-37rg-7r42 · Aviso do Fabricante
• https://github.com/Piwigo/Piwigo/commit/552499e0533ce54b55f4304b41ca6cd7ccce51f8 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2024-48928 · Nota de Segurança
• https://twitter.com/CVEnew/status/2026676446564139111 · Publicação no Twitter
• https://t.me/CVEtracker/45630 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2024-48928 · Aviso do Fabricante