PT-2005-1302 · Gallery · Gallery

Rafel Ivgi + 1 · Published 2005-01-17 · Updated 2017-07-11 · CVE-2005-0221

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Gallery version 2.0 Alpha

Description A cross-site scripting issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the g2 form[subject] field in the login.php file.

Recommendations For Gallery version 2.0 Alpha, consider restricting access to the login.php file until a fix is available, and avoid using the g2 form[subject] field in the affected API endpoint. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Related Identifiers

CVE-2005-0221

Affected Products

Gallery

References · 8

• 🔥 http://theinsider.deep-ice.com/texts/advisory69.txt · Exploit
• 🔥 http://gallery.menalto.com/modules.php?op=modload&name=News&file=article&sid=147 · Exploit
• 🔥 http://archives.neohapsis.com/archives/vulnwatch/2005-q1/0031.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-0221 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18938 · Note
• http://marc.info/?l=bugtraq&m=110608459222364&w=2 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0221 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43472 · Note