File Upload and CSRF Vulnerabilities in NextGen Gallery Plugin for WordPress
CVE-2015-1784

8.8HIGH

Key Information:

Vendor
Wordpress
Status
Nextgen-gallery
Vendor
CVE Published:
7 July 2022

Summary

The NextGen Gallery plugin for WordPress, prior to version 2.0.77.3, contains critical vulnerabilities that compromise web application security. The flaws are primarily due to improper validation of user-uploaded files and inadequate security measures against unwanted HTTP requests. These vulnerabilities could be exploited by attackers to potentially gain unauthorized access to the application and its data. Users are advised to restrict the plugin version and apply necessary updates to avoid these risks.

Affected Version(s)

nextgen-gallery nextgen-gallery 2.0.77.3

References

https://wpscan.com/vulnerability/c894727a-b779-4583-a860-...
x_refsource_MISC
https://blog.nettitude.com/uk/crsf-and-unsafe-arbitrary-f...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.