PT-2017-6240 · Grand Flag · Grand Flagallery

Published 2017-10-18 · Updated 2017-11-08 · CVE-2014-8491

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Grand Flagallery plugin versions prior to 4.25

Description The issue allows remote attackers to obtain the installation path. This can be achieved by sending a request to API endpoints such as "flagallery-skins/banner widget default/gallery.php" or "flash-album-gallery/skins/banner widget default/gallery.php".

Recommendations For Grand Flagallery plugin versions prior to 4.25, update to version 4.25 or later to resolve the issue.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2014-8491

Affected Products

Grand Flagallery

References · 4

• 🔥 https://g0blin.co.uk/cve-2014-8491 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-8491 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8491 · Note
• https://wpvulndb.com/vulnerabilities/8238 · Note