VulnerabilityModified
CVE-2005-3764
The image gallery (imagegallery) component in Exponent CMS 0.96.3 and later versions does not properly check the MIME type of uploaded files, with unknown impact from the preview icon, possibly involving injection of HTML.
HIGH 10.0EPSS 1.38%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.38%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The image gallery (imagegallery) component in Exponent CMS 0.96.3 and later versions does not properly check the MIME type of uploaded files, with unknown impact from the preview icon, possibly involving injection of HTML.
- CVSS 2.0
- 10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 1.38% probability · 70th percentile
- CISA KEV
- Not listed
- Affected
- exponent/exponent
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/17655Vendor Advisory
- http://www.securityfocus.com/archive/1/417218Vendor Advisory
- http://secunia.com/advisories/17655Vendor Advisory
- http://www.securityfocus.com/archive/1/417218Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.