PT-2022-7810 · WordPress · Nextgen Gallery

Louie Augarde · Published 2022-07-07 · Updated 2022-07-14 · CVE-2015-1784

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions nextgen-galery wordpress plugin versions prior to 2.0.77.3

Description The issue lies in the validation of user-uploaded files and the lack of security measures to prevent unwanted HTTP requests, allowing an attacker to gain full access to the web application.

Recommendations For versions prior to 2.0.77.3, update to version 2.0.77.3 or later to resolve the issue.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2015-1784

Affected Products

Nextgen Gallery

References · 4

• 🔥 https://blog.nettitude.com/uk/crsf-and-unsafe-arbitrary-file-upload-in-nextgen-gallery-plugin-for-wordpress · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-1784 · Security Note
• https://t.me/cibsecurity/45735 · Telegram Post
• https://wpscan.com/vulnerability/c894727a-b779-4583-a860-13c2c27275d4 · Note