Piwigo: Unauthenticated User Enumeration in Password Reset

Summary

An attacker can determine if a username or email address exists in a Piwigo system without needing a password, potentially helping them guess login credentials. This vulnerability affects all Piwigo versions up to and including 15.5.0. Until a patch is available, users can protect themselves by not revealing usernames or email addresses that might be associated with their Piwigo account.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
piwigo	piwigo	> 15.0.0 , <= 15.5.0	–

Original title

Piwigo is an open source photo gallery application for the web. In version 15.5.0 and likely earlier 15.x releases, the password reset functionality in Piwigo allows an unauthenticated attacker to ...

Original description

Piwigo is an open source photo gallery application for the web. In version 15.5.0 and likely earlier 15.x releases, the password reset functionality in Piwigo allows an unauthenticated attacker to determine whether a given username or email address exists in the system. The endpoint at password.php?action=lost returns distinct messages for valid vs. invalid accounts, enabling user enumeration. As of time of publication, no known patches are available.

nvd CVSS3.1 5.3

nvd CVSS4.0 5.5

Vulnerability type

CWE-204

https://github.com/Piwigo/Piwigo/security/advisories/GHSA-h4wx-7m83-xfxc Exploit Mitigation Vendor Advisory