PT-2022-7811 · WordPress · Nextgen Gallery

Louie Augarde · Published 2022-07-07 · Updated 2022-07-14 · CVE-2015-1785

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions nextgen-galery wordpress plugin versions prior to 2.0.77.3

Description The issue lies in the validation of user-uploaded files and the lack of security measures to prevent unwanted HTTP requests, allowing an attacker to gain full access to the web application.

Recommendations For versions prior to 2.0.77.3, update to version 2.0.77.3 or later to resolve the issue. As a temporary workaround, consider restricting access to file upload functionality and limiting HTTP requests to essential ones until the update is applied.

Exploit

Fix

Unrestricted File Upload

CSRF

Weakness Enumeration

CWE-434

CWE-352

Related Identifiers

CVE-2015-1785

Affected Products

Nextgen Gallery

References · 4

• 🔥 https://blog.nettitude.com/uk/crsf-and-unsafe-arbitrary-file-upload-in-nextgen-gallery-plugin-for-wordpress · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-1785 · Security Note
• https://wpscan.com/vulnerability/c894727a-b779-4583-a860-13c2c27275d4 · Note
• https://t.me/cibsecurity/45727 · Telegram Post