Lucene search

CertccCVE-2016-6565

HistoryJul 13, 2018 - 8:29 p.m.

CVE-2016-6565

2018-07-1320:29:01

CWE-98

CWE-20

certcc

web.nvd.nist.gov

imagely nextgen gallery

wordpress

plugin

vulnerability

cve-2016-6565

security

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.8

Confidence

High

EPSS

0.002

Percentile

51.7%

JSON

The Imagely NextGen Gallery plugin for Wordpress prior to version 2.1.57 does not properly validate user input in the cssfile parameter of a HTTP POST request, which may allow an authenticated user to read arbitrary files from the server, or execute arbitrary code on the server in some circumstances (dependent on server configuration).

Affected configurations

Nvd

Node

imagelynextgen_galleryRange<2.1.57wordpress

VendorProductVersionCPE
imagelynextgen_gallery*cpe:2.3:a:imagely:nextgen_gallery:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
imagely	nextgen_gallery	*	cpe:2.3:a:imagely:nextgen_gallery::::::wordpress::*

CNA Affected

[
  {
    "product": "NextGen Gallery plugin",
    "vendor": "Imagely",
    "versions": [
      {
        "lessThan": "2.1.57",
        "status": "affected",
        "version": "2.1.57",
        "versionType": "custom"
      }
    ]
  }
]

References

www.kb.cert.org/vuls/id/346175

www.securityfocus.com/bid/94356/

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.8

Confidence

High

EPSS

0.002

Percentile

51.7%

JSON

Related for CVE-2016-6565