PT-2017-7911 · Piwigo · Piwigo

Plegall · Published 2017-10-10 · Updated 2017-11-05 · CVE-2016-10514

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 2.8.3

Description The issue allows remote attackers to bypass intended access restrictions. This can be achieved via a URL that contains a " character, or a URL beginning with a substring other than the http:// or https:// substring. The problem is located in the url check format function in include/functions.inc.php.

Recommendations For versions prior to 2.8.3, update to version 2.8.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the url check format function in include/functions.inc.php until a patch is available. Avoid using URLs that contain a " character or start with substrings other than http:// or https:// in the affected function.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2016-10514

Affected Products

Piwigo

References · 6

• https://github.com/Piwigo/Piwigo/issues/547 · Patch
• https://github.com/Piwigo/Piwigo/commit/b3157cbfd859c914911b114d4edbba4654758b57 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2016-10514 · Security Note
• https://osv.dev/vulnerability/CVE-2016-10514 · Vendor Advisory
• http://piwigo.org/releases/2.8.3 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10514 · Note