CVE-2017-17827

HIGH

Piwigo - CSRF

Title source: rule

Description

Piwigo 2.9.2 is vulnerable to Cross-Site Request Forgery via /admin.php?page=configuration&section=main or /admin.php?page=batch_manager&mode=unit. An attacker can exploit this to coerce an admin user into performing unintended actions.

References (3)

Core 3

Core References

Third Party Advisory x_refsource_misc

https://github.com/Piwigo/Piwigo/issues/822

Third Party Advisory x_refsource_misc

https://github.com/Piwigo/Piwigo/commit/c3b4c6f7f0ddeaea492080fb8211d7b4cfedaf6f

View Writeup ZIP pw:eip

Third Party Advisory x_refsource_misc

https://github.com/sahildhar/sahildhar.github.io/blob/master/research/reports/Piwigo_2.9.2/Cross%20Site%20Request%20Forgery%20in%20Piwigo%202.9.2.md

View Writeup ZIP pw:eip

Scores

CVSS v3 8.8

EPSS 0.0017

EPSS Percentile 37.2%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-352

Status published

Products (1)

piwigo/piwigo 2.9.2

Published Dec 21, 2017

Tracked Since Feb 18, 2026