PT-2013-3557 · Gallery · Gallery

Jan Lieskovsky · Publicado 2013-10-10 · Atualizado 2013-10-10 · CVE-2013-2138

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Gallery 3 versions prior to 3.0.8

Description The issue affects the uploadify and flowplayer SWF files, allowing remote attackers to have an unspecified impact via a replay attack due to the improper removal of query parameters and fragments.

Recommendations For versions prior to 3.0.8, update to version 3.0.8 or later to resolve the issue.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2013-2138

Produtos afetados

Gallery

Referências · 9

• https://github.com/gallery/gallery3/commit/80bb0f2222dd99ed2ce59e804b833bab63cc376a · Nota
• https://github.com/gallery/gallery3/commit/3e5bba2cd4febe8331c0158c11ea418f21c72efa · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2138 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-2138 · Nota de Segurança
• http://sourceforge.net/apps/trac/gallery/ticket/2068 · Nota
• http://openwall.com/lists/oss-security/2013/06/04/9 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=970596 · Nota
• http://galleryproject.org/gallery_3_0_8 · Aviso do Fabricante
• http://sourceforge.net/apps/trac/gallery/ticket/2070 · Nota