PT-2012-3383 · Coppermine · Coppermine Photo Gallery

Janek Vind + 1 · Publicado 2012-09-04 · Atualizado 2012-09-05 · CVE-2012-1614

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Coppermine Photo Gallery versions prior to 1.5.20

Description The issue allows remote attackers to obtain sensitive information via various invalid parameters to different scripts, which reveals the installation path in an error message. This can be achieved by making a direct request to "plugins/visiblehookpoints/index.php", or by providing an invalid page or cat parameter to "thumbnails.php", an invalid page parameter to "usermgr.php", or an invalid newer than or older than parameter to "search.inc.php".

Recommendations For Coppermine Photo Gallery versions prior to 1.5.20, update to version 1.5.20 or later to resolve the issue.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2012-1614

Produtos afetados

Coppermine Photo Gallery

Referências · 17

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2012-03/0167.html · Exploit
• 🔥 http://osvdb.org/80732 · Exploit
• 🔥 http://waraxe.us/advisory-81.html · Exploit
• 🔥 http://osvdb.org/80734 · Exploit
• 🔥 http://openwall.com/lists/oss-security/2012/04/03/6 · Exploit
• 🔥 http://exploit-db.com/exploits/18680 · Exploit
• 🔥 https://exploit-db.com/exploits/18680 · Exploit
• 🔥 http://osvdb.org/80733 · Exploit
• 🔥 http://osvdb.org/80735 · Exploit
• 🔥 http://packetstormsecurity.org/files/111369/Coppermine-1.5.18-Cross-Site-Scripting-Path-Disclosure.html · Exploit
• http://openwall.com/lists/oss-security/2012/03/30/5 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1614 · Nota
• http://openwall.com/lists/oss-security/2012/03/30/6 · Nota
• http://forum.coppermine-gallery.net/index.php/topic%2C74682.0.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-1614 · Nota de Segurança