PT-2007-6744 · Blue Collar Productions · I-Gallery

Published 2007-11-01 · Updated 2018-10-15 · CVE-2007-5777

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Blue-Collar Productions i-Gallery version 3.4

Description The issue allows remote attackers to download a file containing a base64-encoded password via a direct request for "igallery.mdb". This is due to insufficient access control, as sensitive information is stored under the web root.

Recommendations For version 3.4, consider restricting access to the "igallery.mdb" file to prevent unauthorized downloads, and review the access control settings for sensitive information stored under the web root.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2007-5777

Affected Products

I-Gallery

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2007-5777 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5777 · Note
• http://osvdb.org/43629 · Note
• http://securityreason.com/securityalert/3330 · Note
• http://securityfocus.com/archive/1/482788/100/0/threaded · Note