CVE

Id
71911  
CVE No.
CVE-2014-4614  
Status
Candidate  
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in Piwigo before 2.6.2 allow remote attackers to hijack the authentication of administrators for requests that use the (1) pwg.groups.addUser, (2) pwg.groups.deleteUser, (3) pwg.groups.setInfo, (4) pwg.users.setInfo, (5) pwg.permissions.add, or (6) pwg.permissions.remove method.  
Phase
Assigned (20140624)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
682373 71911 CVE-2014-4614 MLIST:[oss-security] 20140624 Re: CVE request: Piwigo before 2.6.2 ws.php Arbitrary User Creation CSRF  View
682374 71911 CVE-2014-4614 URL:http://seclists.org/oss-sec/2014/q2/623  View
682375 71911 CVE-2014-4614 CONFIRM:http://piwigo.org/bugs/view.php?id=0003055  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
15373 JVNDB-2014-004248 EMC Documentum Content Server におけるスーパーユーザ権限を取得される脆弱性 EMC Documentum Content Server は、特権グループのサブグループの認証を適切にチェックしないため、スーパーユーザ権限を取得され、データアクセスおよびサーバアクションの制限を回避される脆弱性が存在します。 CVE-2014-4622 71911 7.1 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-004248.html  View