CVE-2016-3735

Piwigo is image gallery software written in PHP. When a criteria is not met on a host, piwigo defaults to usingmt_rand in order to generate password reset tokens. mt_rand output can be predicted after recovering the seed used to generate it. This low an unauthenticated attacker to take over an account providing they know an administrators email address in order to be able to request password reset.

CVSS v3 8.1 HIGH
CVSS v2.0 6.8 MEDIUM

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://piwigo.org/release-2.8.1%2C
https://github.com/Piwigo/Piwigo/commit/f51ee90c66527fd7ff634f3e8d414cb670da068d	Patch Third Party Advisory
https://github.com/Piwigo/Piwigo/issues/470%2C

Configurations

Configuration 1 (hide)

cpe:2.3:a:piwigo:piwigo:*:*:*:*:*:*:*:*

History

07 Nov 2023, 02:32

Type	Values Removed	Values Added
References	~~{'url': 'http://piwigo.org/release-2.8.1,', 'name': 'http://piwigo.org/release-2.8.1,', 'tags': ['Broken Link'], 'refsource': 'MISC'}~~ ~~{'url': 'https://github.com/Piwigo/Piwigo/issues/470,', 'name': 'https://github.com/Piwigo/Piwigo/issues/470,', 'tags': ['Broken Link'], 'refsource': 'MISC'}~~	() https://github.com/Piwigo/Piwigo/issues/470%2C - () http://piwigo.org/release-2.8.1%2C -

Information

Published : 2022-01-28 20:15

Updated : 2024-02-28 18:48

NVD link : CVE-2016-3735

Mitre link : CVE-2016-3735

CVE.ORG link : CVE-2016-3735

JSON object : View

Products Affected

piwigo

piwigo

CWE

CWE-335

Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)

{"id": "CVE-2016-3735", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}]}, "published": "2022-01-28T20:15:08.437", "references": [{"url": "http://piwigo.org/release-2.8.1%2C", "source": "secalert@redhat.com"}, {"url": "https://github.com/Piwigo/Piwigo/commit/f51ee90c66527fd7ff634f3e8d414cb670da068d", "tags": ["Patch", "Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://github.com/Piwigo/Piwigo/issues/470%2C", "source": "secalert@redhat.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-335"}]}, {"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-335"}]}], "descriptions": [{"lang": "en", "value": "Piwigo is image gallery software written in PHP. When a criteria is not met on a host, piwigo defaults to usingmt_rand in order to generate password reset tokens. mt_rand output can be predicted after recovering the seed used to generate it. This low an unauthenticated attacker to take over an account providing they know an administrators email address in order to be able to request password reset."}, {"lang": "es", "value": "Piwigo es un software de galer\u00eda de im\u00e1genes escrito en PHP. Cuando no es cumplido un criterio en un host, piwigo usa por defecto mt_rand para generar tokens de restablecimiento de contrase\u00f1a. La salida de mt_rand puede predecirse tras recuperar la semilla usada para generarla. Esto permite a un atacante no autenticado hacerse con una cuenta siempre que conozca la direcci\u00f3n de correo electr\u00f3nico del administrador para poder solicitar el restablecimiento de la contrase\u00f1a"}], "lastModified": "2023-11-07T02:32:25.800", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:piwigo:piwigo:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "294E7F72-0D7D-4B0C-B05E-B58EFB07CF35", "versionEndExcluding": "2.8.1"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}