CVE-2016-10514

Опубликовано: 10 окт. 2017

Источник: nvd

CVSS3: 6.5

CVSS2: 4.3

EPSS Низкий

Описание

url_check_format in include/functions.inc.php in Piwigo before 2.8.3 allows remote attackers to bypass intended access restrictions via a URL that contains a " character, or a URL beginning with a substring other than the http:// or https:// substring.

Ссылки

http://piwigo.org/releases/2.8.3
Patch
Release Notes
Vendor Advisory
https://github.com/Piwigo/Piwigo/commit/b3157cbfd859c914911b114d4edbba4654758b57
Issue Tracking
Patch
Third Party Advisory
https://github.com/Piwigo/Piwigo/issues/547
Issue Tracking
Patch
Third Party Advisory
http://piwigo.org/releases/2.8.3
Patch
Release Notes
Vendor Advisory
https://github.com/Piwigo/Piwigo/commit/b3157cbfd859c914911b114d4edbba4654758b57
Issue Tracking
Patch
Third Party Advisory
https://github.com/Piwigo/Piwigo/issues/547
Issue Tracking
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:piwigo:piwigo:*:*:*:*:*:*:*:*

Версия до 2.8.2 (включая)

EPSS

Процентиль: 51%

0.00285

Низкий

6.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-284

Связанные уязвимости

CVE-2016-10514

CVSS3: 6.5

ubuntu

больше 8 лет назад

CVE-2016-10514

CVSS3: 6.5

debian

больше 8 лет назад

url_check_format in include/functions.inc.php in Piwigo before 2.8.3 a ...

GHSA-jcp2-3g53-9xq3

CVSS3: 6.5

github

больше 3 лет назад

EPSS

Процентиль: 51%

0.00285

Низкий

6.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-284