CVE-2016-3735CWE-335

Piwigo is image gallery software written in PHP

published January 28, 2022

CVSS
—
EPSS
1%
Percentile
71.4
In the wild
Unconfirmed
What it is

Piwigo is image gallery software written in PHP. When a criteria is not met on a host, piwigo defaults to usingmt_rand in order to generate password reset tokens. mt_rand output can be predicted after recovering the seed used to generate it. This low an unauthenticated attacker to take over an account providing they know an administrators email address in order to be able to request password reset.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01363 · 71.4th percentile
Weakness
CWE-335 · Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)
Published
2022-01-28T00:00Z
EPSS history
Timeline
  • 28 JAN 00:00Z
    Piwigo is image gallery software written in PHP
    cvelistv5