PT-2008-1650 · Menalto · Menalto Gallery

Publicado 2008-01-17 · Atualizado 2008-11-15 · CVE-2007-6687

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Menalto Gallery versions prior to 2.2.4

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via crafted filenames to the Core or add-item modules, or via HTTP PROPPATCH in the WebDAV module.

Recommendations For versions prior to 2.2.4, update to version 2.2.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the Core, add-item, and WebDAV modules until the update is applied. Avoid using crafted filenames and restrict HTTP PROPPATCH requests in the WebDAV module to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2007-6687

Produtos afetados

Menalto Gallery

Referências · 9

• http://osvdb.org/41671 · Nota
• http://osvdb.org/41673 · Nota
• http://secunia.com/advisories/28898 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-6687 · Nota de Segurança
• http://security.gentoo.org/glsa/glsa-200802-04.xml · Aviso do Fabricante
• http://bugs.gentoo.org/show_bug.cgi?id=203217 · Nota
• http://osvdb.org/41672 · Nota
• http://gallery.menalto.com/gallery_2.2.4_released · Correção
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6687 · Nota