PT-2022-7862 · Piwigo · Piwigo

Published 2022-01-28 · Updated 2022-11-07 · CVE-2016-3735

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Piwigo (affected versions not specified)

Description The issue affects Piwigo, an image gallery software written in PHP. When certain criteria are not met on a host, Piwigo defaults to using mt rand to generate password reset tokens. The output of mt rand can be predicted after recovering the seed used to generate it, allowing an unauthenticated attacker to take over an account if they know an administrator's email address and can request a password reset.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-335

Related Identifiers

CVE-2016-3735

Affected Products

Piwigo

References · 6

• https://github.com/Piwigo/Piwigo/commit/f51ee90c66527fd7ff634f3e8d414cb670da068d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2016-3735 · Security Note
• https://osv.dev/vulnerability/CVE-2016-3735 · Vendor Advisory
• https://github.com/Piwigo/Piwigo/issues/470%2C · Note
• https://t.me/cibsecurity/36483 · Telegram Post
• http://piwigo.org/release-2.8.1%2C · Note