PT-2013-3615 · Gallery · Gallery

Jan Lieskovsky · Published 2013-10-10 · Updated 2013-10-10 · CVE-2013-2240

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Gallery 3 versions prior to 3.0.9

Description The issue is related to the lib/flowplayer.swf.php file, which does not properly remove query fragments. This allows remote attackers to have an unspecified impact via a replay attack.

Recommendations For versions prior to 3.0.9, update to version 3.0.9 or later to resolve the issue.

Exploit

Fix

Related Identifiers

CVE-2013-2240

Affected Products

Gallery

References · 7

• 🔥 https://github.com/gallery/gallery3/commit/c5318bb1a2dd266b50317a2adb74d74338593733 · Exploit
• https://bugzilla.redhat.com/show_bug.cgi?id=981197 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2013-2240 · Security Note
• http://openwall.com/lists/oss-security/2013/07/04/11 · Note
• http://sourceforge.net/apps/trac/gallery/ticket/2073 · Note
• http://galleryproject.org/gallery_3_0_9 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2240 · Note