Piwigo CVE-2017-10681 Cross-Site Request Forgery Vulnerability
BID:99362
Info
Piwigo CVE-2017-10681 Cross-Site Request Forgery Vulnerability
| Bugtraq ID: | 99362 |
| Class: | Input Validation Error |
| CVE: |
CVE-2017-10681 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 03 2017 12:00AM |
| Updated: | Jul 03 2017 12:00AM |
| Credit: | topsec(Li Zhiqiang) |
| Vulnerable: |
Piwigo Piwigo 2.9.1 Piwigo Piwigo 2.9 Piwigo Piwigo 2.8.6 Piwigo Piwigo 2.8.3 Piwigo Piwigo 2.7.4 Piwigo Piwigo 2.7.3 Piwigo Piwigo 2.7.2 Piwigo Piwigo 2.6.3 Piwigo Piwigo 2.6.1 Piwigo Piwigo 2.5.2 Piwigo Piwigo 2.4.7 Piwigo Piwigo 2.4.6 Piwigo Piwigo 2.4.5 Piwigo Piwigo 2.4.4 Piwigo Piwigo 2.4.3 Piwigo Piwigo 2.3.4 Piwigo Piwigo 2.3.3 Piwigo Piwigo 2.3.2 Piwigo Piwigo 2.1.3 Piwigo Piwigo 2.1.2 Piwigo Piwigo 2.0.9 Piwigo Piwigo 2.0.8 Piwigo Piwigo 2.0.7 Piwigo Piwigo 2.0.6 Piwigo Piwigo 2.0.5 Piwigo Piwigo 2.0.3 Piwigo Piwigo 2.0 Piwigo Piwigo 2.7.1 Piwigo Piwigo 2.7.0 Piwigo Piwigo 2.6.4 Piwigo Piwigo 2.6.0 Piwigo Piwigo 2.5.5 Piwigo Piwigo 2.5.3 Piwigo Piwigo 2.5.0 Piwigo Piwigo 2.4.2 Piwigo Piwigo 2.4.1 Piwigo Piwigo 2.4.0 Piwigo Piwigo 2.3.5 Piwigo Piwigo 2.3.1 Piwigo Piwigo 2.3.0 Piwigo Piwigo 2.2.5 Piwigo Piwigo 2.2.4 Piwigo Piwigo 2.2.3 Piwigo Piwigo 2.2.2 Piwigo Piwigo 2.2.1 Piwigo Piwigo 2.2.0 Piwigo Piwigo 2.1.6 Piwigo Piwigo 2.1.5 Piwigo Piwigo 2.1.4 Piwigo Piwigo 2.1.1 Piwigo Piwigo 2.1.0 Piwigo Piwigo 2.0.4 Piwigo Piwigo 2.0.2 Piwigo Piwigo 2.0.1 Piwigo Piwigo 1.7.3 Piwigo Piwigo 1.7.2 Piwigo Piwigo 1.7.1 Piwigo Piwigo 1.7.0 Piwigo Piwigo 1.6.2 Piwigo Piwigo 1.6.1 Piwigo Piwigo 1.6.0 Piwigo Piwigo 1.5.2 Piwigo Piwigo 1.5.1 Piwigo Piwigo 1.5.0 Piwigo Piwigo 1.4.1 Piwigo Piwigo 1.4.0 Piwigo Piwigo 1.3.4 Piwigo Piwigo 1.3.3 Piwigo Piwigo 1.3.2 Piwigo Piwigo 1.3.1 Piwigo Piwigo 1.3.0 Piwigo Piwigo 1.2.1 Piwigo Piwigo 1.2.0 Piwigo Piwigo 1.1.0 Piwigo Piwigo 1.0.2 Piwigo Piwigo 1.0.1 |
| Not Vulnerable: | |
Discussion
Piwigo CVE-2017-10681 Cross-Site Request Forgery Vulnerability
Piwigo is prone to a cross-site request-forgery vulnerability.
Exploiting this issue may allow a remote attacker to perform certain unauthorized actions in the context of the affected application. Other attacks are also possible.
Piwigo 2.9.1 and prior versions are vulnerable.
Piwigo is prone to a cross-site request-forgery vulnerability.
Exploiting this issue may allow a remote attacker to perform certain unauthorized actions in the context of the affected application. Other attacks are also possible.
Piwigo 2.9.1 and prior versions are vulnerable.
Exploit / POC
Piwigo CVE-2017-10681 Cross-Site Request Forgery Vulnerability
The researcher has created a proof-of-concept to demonstrate the issue. Please see the references for more information.
The researcher has created a proof-of-concept to demonstrate the issue. Please see the references for more information.
Solution / Fix
Piwigo CVE-2017-10681 Cross-Site Request Forgery Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Piwigo CVE-2017-10681 Cross-Site Request Forgery Vulnerability
References:
References: