PT-2006-2153 · Gallery · Gallery

Published 2006-03-09 · Updated 2017-07-20 · CVE-2006-1126

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Gallery versions up to 2.0.2

Description The issue allows remote attackers to spoof their IP address by modifying the X-Forwarded-For HTTP header. This header is checked by Gallery before other more reliable sources of IP address information, such as REMOTE ADDR.

Recommendations For Gallery versions up to 2.0.2, consider updating to a version that prioritizes more reliable sources of IP address information, such as REMOTE ADDR, over the X-Forwarded-For header to prevent IP address spoofing.

Fix

Related Identifiers

CVE-2006-1126

Affected Products

Gallery

References · 9

• http://securitytracker.com/id?1015717 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-1126 · Security Note
• http://secunia.com/advisories/19104 · Vendor Advisory
• http://gulftech.org/?node=research&article_id=00106-03022006 · Patch
• http://archives.neohapsis.com/archives/bugtraq/2006-02/0621.html · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1126 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25120 · Note
• http://gallery.menalto.com/gallery_2.0.3_released · Note
• http://vupen.com/english/advisories/2006/0813 · Note