CVE-2014-4614: CSRF
Multiple cross-site request forgery (CSRF) vulnerabilities in Piwigo before 2.6.2 allow remote attackers to hijack the authentication of administrators for requests that use the (1) pwg.groups.addUser, (2) pwg.groups.deleteUser, (3) pwg.groups.setInfo, (4) pwg.users.setInfo, (5) pwg.permissions.add, or (6) pwg.permissions.remove method.
Affected Software
Event History
Frequently Asked Questions
What types of vulnerabilities does CVE-2014-4614 include?
CVE-2014-4614 includes multiple cross-site request forgery (CSRF) vulnerabilities affecting Piwigo.
Who is affected by CVE-2014-4614?
CVE-2014-4614 affects administrators of Piwigo versions prior to 2.6.2.
What actions can attackers perform using CVE-2014-4614?
Attackers can hijack administrator authentication for various actions such as adding or deleting users and modifying group information.
How can I mitigate the risks associated with CVE-2014-4614?
The best mitigation is to upgrade to Piwigo version 2.6.2 or later to patch the vulnerabilities.
What is the potential impact of CVE-2014-4614 on my Piwigo installation?
CVE-2014-4614 could allow unauthorized access and manipulation of user groups and permissions, compromising the integrity of your Piwigo installation.