CVE-2016-10105: Infoleak
Published Jan 3, 2017
·Updated
admin/plugin.php in Piwigo through 2.8.3 doesn't validate the sections variable while using it to include files. This can cause information disclosure and code execution if it contains a .. sequence.
Affected Software
1 affected component
Piwigo piwigo<=2.8.3
Remediation
Event History
Jan 3, 2017
CVE Published
via MITRE·06:34 AM
Data Sourced
via MITRE·06:34 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-10105?
CVE-2016-10105 is classified as a high severity vulnerability due to its potential for code execution and information disclosure.
2
How do I fix CVE-2016-10105?
To fix CVE-2016-10105, upgrade Piwigo to version 2.8.4 or later where the vulnerability has been addressed.
3
What kind of attacks can exploit CVE-2016-10105?
CVE-2016-10105 can be exploited through directory traversal attacks allowing an attacker to access sensitive files.
4
Which versions of Piwigo are affected by CVE-2016-10105?
CVE-2016-10105 affects Piwigo versions up to and including 2.8.3.
5
Can CVE-2016-10105 lead to remote code execution?
Yes, CVE-2016-10105 can lead to remote code execution if exploited via the insecure handling of the sections variable.