File Upload and Request Validation Vulnerabilities in NextGEN Gallery Plugin for WordPress
CVE-2015-1785

6.5MEDIUM

Key Information:

Vendor
Wordpress
Status
Nextgen-gallery
Vendor
CVE Published:
7 July 2022

Summary

The NextGEN Gallery Plugin for WordPress, prior to version 2.0.77.3, contains significant vulnerabilities that could allow attackers to take full control of the application. These issues stem from inadequate validation of user-uploaded files coupled with a lack of security measures that guard against malicious HTTP requests. Exploiting these vulnerabilities could lead to unauthorized access and potentially compromise the entire web application.

Affected Version(s)

nextgen-gallery nextgen-gallery 2.0.77.3

References

https://wpscan.com/vulnerability/c894727a-b779-4583-a860-...
x_refsource_MISC
https://blog.nettitude.com/uk/crsf-and-unsafe-arbitrary-f...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.