PT-2019-7496 · WordPress · Nextgen Gallery

Sathish · Published 2019-11-26 · Updated 2020-11-10 · CVE-2015-9537

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions NextGEN Gallery plugin versions prior to 2.1.10

Description The issue involves multiple XSS problems related to parameters such as thumbnail width, thumbnail height, thumbwidth, thumbheight, wmXpos, and wmYpos, as well as template issues.

Recommendations For versions prior to 2.1.10, update to version 2.1.10 or later to resolve the issue. As a temporary workaround, consider restricting access to the affected parameters and template until the update is applied. Avoid using the parameters thumbnail width, thumbnail height, thumbwidth, thumbheight, wmXpos, and wmYpos in the affected template until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2015-9537

Affected Products

Nextgen Gallery

References · 6

• 🔥 https://github.com/cybersecurityworks/Disclosed/issues/1 · Exploit
• 🔥 https://cybersecurityworks.com/zerodays/cve-2015-9537-nextgen.html · Exploit
• 🔥 https://openwall.com/lists/oss-security/2015/10/27/4 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-9537 · Security Note
• https://wordpress.org/plugins/nextgen-gallery/#developers · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9537 · Note