{"api_version":"1","generated_at":"2026-07-23T04:57:44+00:00","cve":"CVE-2017-9464","urls":{"html":"https://cve.report/CVE-2017-9464","api":"https://cve.report/api/cve/CVE-2017-9464.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2017-9464","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2017-9464"},"summary":{"title":"CVE-2017-9464","description":"An open redirect vulnerability is present in Piwigo 2.9 and probably prior versions, allowing remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. The identification.php component is affected by this issue: the \"redirect\" parameter is not validated.","state":"PUBLISHED","assigner":"mitre","published_at":"2017-06-14 19:29:00","updated_at":"2025-04-20 01:37:25"},"problem_types":["CWE-601","n/a"],"metrics":[{"version":"3.0","source":"nvd@nist.gov","type":"Primary","score":"6.1","severity":"MEDIUM","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","data":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"}},{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"5.8","severity":"","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:N","baseScore":5.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2017-007","name":"https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2017-007","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Third Party Advisory"],"title":"wizlynx group | Unvalidated Redirects and Forwards in Piwigo","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://github.com/Piwigo/Piwigo/issues/706","name":"https://github.com/Piwigo/Piwigo/issues/706","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Patch","Third Party Advisory"],"title":"identification should redirect within Piwigo only · Issue #706 · Piwigo/Piwigo · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-9464","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-9464","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2017","cve_id":"9464","vulnerable":"1","versionEndIncluding":"2.9.0","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"piwigo","cpe5":"piwigo","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-05T17:11:01.771Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_MISC","x_transferred"],"url":"https://github.com/Piwigo/Piwigo/issues/706"},{"tags":["x_refsource_MISC","x_transferred"],"url":"https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2017-007"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2017-06-14T00:00:00.000Z","descriptions":[{"lang":"en","value":"An open redirect vulnerability is present in Piwigo 2.9 and probably prior versions, allowing remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. The identification.php component is affected by this issue: the \"redirect\" parameter is not validated."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-06-14T19:57:02.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"tags":["x_refsource_MISC"],"url":"https://github.com/Piwigo/Piwigo/issues/706"},{"tags":["x_refsource_MISC"],"url":"https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2017-007"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2017-9464","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"An open redirect vulnerability is present in Piwigo 2.9 and probably prior versions, allowing remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. The identification.php component is affected by this issue: the \"redirect\" parameter is not validated."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"https://github.com/Piwigo/Piwigo/issues/706","refsource":"MISC","url":"https://github.com/Piwigo/Piwigo/issues/706"},{"name":"https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2017-007","refsource":"MISC","url":"https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2017-007"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2017-9464","datePublished":"2017-06-14T19:00:00.000Z","dateReserved":"2017-06-06T00:00:00.000Z","dateUpdated":"2024-08-05T17:11:01.771Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2017-06-14 19:29:00","lastModifiedDate":"2025-04-20 01:37:25","problem_types":["CWE-601","n/a"],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:N","baseScore":5.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:piwigo:piwigo:*:*:*:*:*:*:*:*","versionEndIncluding":"2.9.0","matchCriteriaId":"1931608C-2835-4E94-AC78-CCBB6C9EC9E5"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2017","CveId":"9464","Ordinal":"1","Title":"CVE-2017-9464","CVE":"CVE-2017-9464","Year":"2017"},"notes":[{"CveYear":"2017","CveId":"9464","Ordinal":"1","NoteData":"An open redirect vulnerability is present in Piwigo 2.9 and probably prior versions, allowing remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. The identification.php component is affected by this issue: the \"redirect\" parameter is not validated.","Type":"Description","Title":"CVE-2017-9464"},{"CveYear":"2017","CveId":"9464","Ordinal":"2","NoteData":"2017-06-14","Type":"Other","Title":"Published"},{"CveYear":"2017","CveId":"9464","Ordinal":"3","NoteData":"2017-06-14","Type":"Other","Title":"Modified"}]}}}