Vulnerability CVE-2016-10514
Published: 2017-10-10   Modified: 2017-10-11

Description:
url_check_format in include/functions.inc.php in Piwigo before 2.8.3 allows remote attackers to bypass intended access restrictions via a URL that contains a " character, or a URL beginning with a substring other than the http:// or https:// substring.

CVSS2 => (AV:N/AC:M/Au:N/C:N/I:P/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
4.3/10
2.9/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
None
Partial
None
Affected software
Piwigo -> Piwigo 

 References:
http://piwigo.org/releases/2.8.3
https://github.com/Piwigo/Piwigo/commit/b3157cbfd859c914911b114d4edbba4654758b57
https://github.com/Piwigo/Piwigo/issues/547
Copyright 2024, cxsecurity.com

 

Back to Top