CVE-2014-4612

Published: Mar 16, 2018Modified: Nov 21, 2024

6.1

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

Cross-site scripting (XSS) vulnerability in the keywords manager (keywordmgr.php) in Coppermine Photo Gallery before 1.5.27 and 1.6.x before 1.6.01 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Affected (2)

Products: Coppermine Gallery: Coppermine Photo Gallery

Coppermine Gallery

1 product

Coppermine Photo Gallery

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Coppermine Gallery Coppermine Photo Gallery	Before 1.5.28
Coppermine Gallery Coppermine Photo Gallery	From 1.6.0 to 1.6.01

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (14)

http://forum.coppermine-gallery.net/index.php/topic%2C77376.0.html

Source: cve@mitre.org

http://seclists.org/oss-sec/2014/q2/608

Source: cve@mitre.org

Mailing ListPatchThird Party Advisory

http://seclists.org/oss-sec/2014/q2/620

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://sourceforge.net/p/coppermine/code/8674

Source: cve@mitre.org

Patch

http://www.securityfocus.com/bid/68140

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://sourceforge.net/p/coppermine/code/8674/tree//trunk/cpg1.5.x/CHANGELOG.txt

Source: cve@mitre.org

Release Notes

https://sourceforge.net/p/coppermine/code/8674/tree//trunk/cpg1.6.x/CHANGELOG.txt

Source: cve@mitre.org

Release Notes

http://forum.coppermine-gallery.net/index.php/topic%2C77376.0.html