What is CVE-2017-16893?

CVE-2017-16893 is a medium-severity vulnerability in Piwigo, classified under SQL Injection. CVSS score: 6.5/10. Published 2017-12-01.

How severe is CVE-2017-16893?

Medium severity. CVSS v3 base score is 6.5 out of 10.

SQL Injection in Piwigo

CVE-2017-16893

The application Piwigo is affected by an SQL injection vulnerability in version 2.9.2 and possibly prior. This vulnerability allows remote authenticated attackers to obtain information in the context of the user used by the application to retrieve data from the database. tags.php is affected: values of the edit_list parameters are not sanitized; these are used to construct an SQL query and retrieve a list of registered users into the application.

Vulnerability class: SQL Injection

EPSS: 0.014 (69.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Piwigo
N/a — versions n/a

Weakness classification (CWE)

CWE-89 — SQL Injection

References

cve@mitre.org (x_refsource_MISC, Issue Tracking)

Frequently asked questions

What is CVE-2017-16893?: CVE-2017-16893 is a medium-severity vulnerability in Piwigo, classified under SQL Injection. CVSS score: 6.5/10. Published 2017-12-01.
How severe is CVE-2017-16893?: Medium severity. CVSS v3 base score is 6.5 out of 10.