Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Tue, 24 Jun 2014 01:54:47 -0400 (EDT)
From: cve-assign@...re.org
To: henri@...v.fi
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE request: Piwigo before 2.6.2 ws.php Arbitrary User Creation CSRF

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

This apparently has two discoverers who worked on different dates, so
it has two CVEs:

> http://packetstormsecurity.com/files/125438/Piwigo-2.6.1-Cross-Site-Request-Forgery.html

Use CVE-2014-4613 for the pwg.users.add vector.


> http://piwigo.org/bugs/view.php?id=0003055

Use CVE-2014-4614 for the pwg.groups.addUser, pwg.groups.deleteUser,
pwg.groups.setInfo, pwg.users.setInfo, pwg.permissions.add, and
pwg.permissions.remove vectors.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJTqRJmAAoJEKllVAevmvmsfRcH/1zYKcPXm6bAaiNk1e84w9wt
QgeFxGikYxQnxZlf7gED+QPno7KLGgqtWiJMzwTEJLga8SjqqGU+lVlJ7V2mly1m
uGC/R4+E1Jamajql2I+KnlvGelfHhB3e1ICpssqc5+EWzV60akelfqnNwSe8/VN6
ZVJ1GTOTz30Q32YRH6IJJ4xhL6gZN57SkDRk4ApB24+ALzECSDhxr5S1OqWHruKR
Y+KbfU+peIZi0Nfy8huFA5hHTUqYP+A74iKiFQTDIDgY3VQiJjmexEmDDb7PzCgf
yMzYcHjF6KZlSqltez0wjirx11z7UmzQDwO6Sjpr+jtCaSsQrstfoLhHgmUskvk=
=xJzF
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.