PT-2006-2153 · Gallery · Gallery

Publicado 2006-03-09 · Atualizado 2017-07-20 · CVE-2006-1126

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Gallery versions up to 2.0.2

Description The issue allows remote attackers to spoof their IP address by modifying the X-Forwarded-For HTTP header. This header is checked by Gallery before other more reliable sources of IP address information, such as REMOTE ADDR.

Recommendations For Gallery versions up to 2.0.2, consider updating to a version that prioritizes more reliable sources of IP address information, such as REMOTE ADDR, over the X-Forwarded-For header to prevent IP address spoofing.

Correção

Identificadores relacionados

CVE-2006-1126

Produtos afetados

Gallery

Referências · 9

• http://securitytracker.com/id?1015717 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1126 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25120 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-1126 · Nota de Segurança
• http://secunia.com/advisories/19104 · Aviso do Fabricante
• http://gulftech.org/?node=research&article_id=00106-03022006 · Correção
• http://archives.neohapsis.com/archives/bugtraq/2006-02/0621.html · Aviso do Fabricante
• http://gallery.menalto.com/gallery_2.0.3_released · Nota
• http://vupen.com/english/advisories/2006/0813 · Nota