Description
Cross-site request forgery (CSRF) vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack the authentication of users for requests to unlock albums via a crafted request.
References (3)
Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/99362
Exploit, Technical Description, Third Party Advisory x_refsource_confirm
https://github.com/Piwigo/Piwigo/issues/721
Patch, Third Party Advisory x_refsource_confirm
https://github.com/Piwigo/Piwigo/commit/03a8329b89c0d196ecdb54227a8113f24555ffc0
Scores
CVSS v3
8.8
EPSS
0.0018
EPSS Percentile
39.1%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Details
CWE
CWE-352
Status
published
Products (1)
piwigo/piwigo
< 2.9.1
Published
Jun 29, 2017
Tracked Since
Feb 18, 2026