CVE-2014-4613

Description

Cross-site request forgery (CSRF) vulnerability in the administration panel in Piwigo before 2.6.2 allows remote attackers to hijack the authentication of administrators for requests that add users via a pwg.users.add action in a request to ws.php.

Weakness classification

• CWE-352: Cross-Site Request Forgery (CSRF)

Primary references

• cve@mitre.org — Broken Link
• cve@mitre.org — Exploit, Third Party Advisory, VDB Entry
• cve@mitre.org — Issue Tracking, Vendor Advisory
• cve@mitre.org — Release Notes
• cve@mitre.org — Mailing List, Third Party Advisory
• cve@mitre.org — Mailing List, Third Party Advisory
• cve@mitre.org — Exploit, Third Party Advisory, VDB Entry
• cve@mitre.org — Third Party Advisory, VDB Entry
• af854a3a-2127-422b-91ae-364da2661108 — Broken Link
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory, VDB Entry
• af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Release Notes