CVE-2016-3735 Weak cryptography in Piwigo
An attacker can predict password reset tokens due to weak random number generation, allowing account takeover if an admin email is known.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-3735?
CVE-2016-3735 is a high-severity vulnerability in Piwigo Piwigo, published on 28 Jan 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Piwigo is image gallery software written in PHP. When a criteria is not met on a host, piwigo defaults to usingmt_rand in order to generate password reset tokens. mt_rand output can be predicted after recovering the seed used to generate it. This low an unauthenticated attacker to take over an account providing they know an administrators email address in order to be able to request password reset.
Weakness: CWE-335
Which versions are affected by CVE-2016-3735?
It affects 1 product.
Products include Piwigo Piwigo.
How do I fix CVE-2016-3735?
No fix has been published for CVE-2016-3735 yet. Limit exposure of the affected software until one is available.
Is CVE-2016-3735 being exploited?
There is no known exploitation of CVE-2016-3735 in the wild and no public exploit code.
Other vulnerabilities in Piwigo Piwigo
Sources
Also known as GHSA-82rp-xg3c-hxpx.