VulnerabilityModified

CVE-2014-4613

Cross-site request forgery (CSRF) vulnerability in the administration panel in Piwigo before 2.6.2 allows remote attackers to hijack the authentication of administrators for requests that add users via a pwg.users.add action in a request to ws.php.

MEDIUM 6.5EPSS 3.10%

Does this matter?

Lower severity and a low EPSS score (3.10%). Track it; it rarely justifies an emergency change on its own.

Description

CVSS 3.0: 6.5 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
EPSS: 3.10% probability · 87th percentile
CISA KEV: Not listed
Weakness: CWE-352
Affected: piwigo/piwigo
Source: cve@mitre.org

References

http://osvdb.org/show/osvdb/103774Broken Link
http://packetstormsecurity.com/files/125438/Piwigo-2.6.1-Cross-Site-Request-Forgery.htmlExploit, Third Party Advisory, VDB Entry
http://piwigo.org/bugs/view.php?id=0003055Issue Tracking, Vendor Advisory
http://piwigo.org/releases/2.6.2Release Notes
http://seclists.org/oss-sec/2014/q2/610Mailing List, Third Party Advisory
http://seclists.org/oss-sec/2014/q2/623Mailing List, Third Party Advisory
http://www.exploit-db.com/exploits/31916Exploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/65811Third Party Advisory, VDB Entry
http://osvdb.org/show/osvdb/103774Broken Link
http://packetstormsecurity.com/files/125438/Piwigo-2.6.1-Cross-Site-Request-Forgery.htmlExploit, Third Party Advisory, VDB Entry
http://piwigo.org/bugs/view.php?id=0003055Issue Tracking, Vendor Advisory
http://piwigo.org/releases/2.6.2Release Notes
http://seclists.org/oss-sec/2014/q2/610Mailing List, Third Party Advisory
http://seclists.org/oss-sec/2014/q2/623Mailing List, Third Party Advisory
http://www.exploit-db.com/exploits/31916Exploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/65811Third Party Advisory, VDB Entry

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.