VulnerabilityModified
CVE-2008-4129
Gallery before 1.5.9, and 2.x before 2.2.6, does not properly handle ZIP archives containing symbolic links, which allows remote authenticated users to conduct directory traversal attacks and read arbitrary files via vectors related to the archive…
MEDIUM 4.0EPSS 1.77%
Does this matter?
Lower severity and a low EPSS score (1.77%). Track it; it rarely justifies an emergency change on its own.
Description
Gallery before 1.5.9, and 2.x before 2.2.6, does not properly handle ZIP archives containing symbolic links, which allows remote authenticated users to conduct directory traversal attacks and read arbitrary files via vectors related to the archive upload (aka zip upload) functionality.
- CVSS 2.0
- 4.0 MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
- EPSS
- 1.77% probability · 77th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- gallery/gallery
- Source
- cve@mitre.org
References
- http://gallery.menalto.com/gallery_1.5.9_releasedPatch
- http://gallery.menalto.com/gallery_2.2.6_releasedPatch
- http://secunia.com/advisories/31912
- http://secunia.com/advisories/32662
- http://secunia.com/advisories/33144
- http://security.gentoo.org/glsa/glsa-200811-02.xml
- http://www.securityfocus.com/bid/31231Patch
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45228
- https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00794.html
- https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00832.html
- http://gallery.menalto.com/gallery_1.5.9_releasedPatch
- http://gallery.menalto.com/gallery_2.2.6_releasedPatch
- http://secunia.com/advisories/31912
- http://secunia.com/advisories/32662
- http://secunia.com/advisories/33144
- http://security.gentoo.org/glsa/glsa-200811-02.xml
- http://www.securityfocus.com/bid/31231Patch
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45228
- https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00794.html
- https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00832.html
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.