CVE-2016-3735: High severity piwigo vulnerability
Piwigo is image gallery software written in PHP. When a criteria is not met on a host, piwigo defaults to usingmtrand in order to generate password reset tokens. mtrand output can be predicted after recovering the seed used to generate it. This low an unauthenticated attacker to take over an account providing they know an administrators email address in order to be able to request password reset.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2016-3735?
CVE-2016-3735 is a vulnerability in the Piwigo image gallery software that allows an unauthenticated attacker to take over an account.
What is the severity of CVE-2016-3735?
CVE-2016-3735 has a severity of 8.1 which is considered high.
How does CVE-2016-3735 affect Piwigo software?
CVE-2016-3735 affects Piwigo software versions up to and excluding 2.8.1.
How can an attacker exploit CVE-2016-3735?
An attacker can exploit CVE-2016-3735 by predicting the output of the mt_rand function used to generate password reset tokens.
Is there a fix for CVE-2016-3735?
Yes, Piwigo software versions after 2.8.1 have addressed the vulnerability. Users are advised to update to the latest version.