Description

Multiple cross-site request forgery (CSRF) vulnerabilities in Piwigo before 2.6.2 allow remote attackers to hijack the authentication of administrators for requests that use the (1) pwg.groups.addUser, (2) pwg.groups.deleteUser, (3) pwg.groups.setInfo, (4) pwg.users.setInfo, (5) pwg.permissions.add, or (6) pwg.permissions.remove method.

Remediation

References

CVE-2014-4614

Related Vulnerabilities

PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2007-4586)

Apache Traffic Server Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') Vulnerability (CVE-2021-43082)

WordPress Plugin Leaflet 'id' Parameter Cross-Site Scripting (0.0.1)

WordPress Plugin LearnPress-WordPress LMS Multiple Vulnerabilities (4.1.7.3.2)

Oracle Database Server CVE-2013-3774 Vulnerability (CVE-2013-3774)

Severity

Medium

Classification

CVE-2014-4614 CWE-352

Tags

Missing Update Known Vulnerabilities