PT-2017-11431 · Piwigo · Piwigo

Flop25 · Published 2017-06-29 · Updated 2017-07-06 · CVE-2017-10679

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 2.9.2

Description The issue allows remote attackers to obtain sensitive information about the descriptive name of a permalink by examining the redirect URL returned in a request for the permalink ID number of a private album. The permalink ID numbers can be easily guessed.

Recommendations For versions prior to 2.9.2, update to version 2.9.2 or later to resolve the issue.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2017-10679

Affected Products

Piwigo

References · 6

• 🔥 https://github.com/Piwigo/Piwigo/issues/721 · Exploit
• https://github.com/Piwigo/Piwigo/issues/723 · Patch
• https://osv.dev/vulnerability/CVE-2017-10679 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-10679 · Security Note
• http://securityfocus.com/bid/99380 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10679 · Note