VulnerabilityModified

CVE-2008-4702

Multiple directory traversal vulnerabilities in PhpWebGallery 1.3.4 allow remote attackers to include and execute arbitrary local files via a ..

HIGH 7.5EPSS 2.49%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (2.49%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Multiple directory traversal vulnerabilities in PhpWebGallery 1.3.4 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) user[language] and (2) user[template] parameters to (a) init.inc.php, and (b) the user[language] parameter to isadmin.inc.php.

CVSS 2.0: 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS: 2.49% probability · 84th percentile
CISA KEV: Not listed
Weakness: CWE-22
Affected: phpwebgallery/phpwebgallery
Source: cve@mitre.org

References

http://securityreason.com/securityalert/4419
https://exchange.xforce.ibmcloud.com/vulnerabilities/45060
https://www.exploit-db.com/exploits/6425
http://securityreason.com/securityalert/4419
https://exchange.xforce.ibmcloud.com/vulnerabilities/45060
https://www.exploit-db.com/exploits/6425

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.