PT-2019-7496 · WordPress · Nextgen Gallery

Sathish · Publicado 2019-11-26 · Atualizado 2020-11-10 · CVE-2015-9537

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions NextGEN Gallery plugin versions prior to 2.1.10

Description The issue involves multiple XSS problems related to parameters such as thumbnail width, thumbnail height, thumbwidth, thumbheight, wmXpos, and wmYpos, as well as template issues.

Recommendations For versions prior to 2.1.10, update to version 2.1.10 or later to resolve the issue. As a temporary workaround, consider restricting access to the affected parameters and template until the update is applied. Avoid using the parameters thumbnail width, thumbnail height, thumbwidth, thumbheight, wmXpos, and wmYpos in the affected template until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2015-9537

Produtos afetados

Nextgen Gallery

Referências · 6

• 🔥 https://github.com/cybersecurityworks/Disclosed/issues/1 · Exploit
• 🔥 https://cybersecurityworks.com/zerodays/cve-2015-9537-nextgen.html · Exploit
• 🔥 https://openwall.com/lists/oss-security/2015/10/27/4 · Exploit
• https://wordpress.org/plugins/nextgen-gallery/#developers · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9537 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-9537 · Nota de Segurança