CVE-2016-3735
Published: 28 January 2022
Summary
CVE-2016-3735 is a high-severity PRNG (CWE-335) vulnerability in Piwigo Piwigo. Its CVSS base score is 8.1 (High).
Operationally, ranked in the top 16.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2016-4748
Vulnerability details
Piwigo is image gallery software written in PHP. When a criteria is not met on a host, piwigo defaults to usingmt_rand in order to generate password reset tokens. mt_rand output can be predicted after recovering the seed used to generate…
more
it. This low an unauthenticated attacker to take over an account providing they know an administrators email address in order to be able to request password reset.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.