CVE-2017-10678 - Cross-site request forgery (CSRF) vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack the authentication of users for requests to delete permalinks via a crafted request

Back Back to CVE browser

HIGH

Cross-site request forgery (CSRF) vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack the authentication of users for requests to delete permalinks via a crafted request

Published Jun 29, 2017

8.8

HIGH

CVSS 3.0

EPSS 1.22%

Description

Cross-site request forgery (CSRF) vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack the authentication of users for requests to delete permalinks via a crafted request.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-352

CSRF

References (4)

http://www.securityfocus.com/bid/99383
vdb-entryx_refsource_BID
https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-2325
Advisory
https://github.com/Piwigo/Piwigo/commit/03a8329b89c0d196ecdb54227a8113f24555ffc0
x_refsource_CONFIRMPatchThird Party Advisory
https://github.com/Piwigo/Piwigo/issues/721
x_refsource_CONFIRMExploitTechnical DescriptionThird Party Advisory

Link	Providers	Tags
http://www.securityfocus.com/bid/99383		vdb-entryx_refsource_BID
https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-2325		Advisory
https://github.com/Piwigo/Piwigo/commit/03a8329b89c0d196ecdb54227a8113f24555ffc0		x_refsource_CONFIRMPatchThird Party Advisory
https://github.com/Piwigo/Piwigo/issues/721		x_refsource_CONFIRMExploitTechnical DescriptionThird Party Advisory