VulnerabilityModified

CVE-2014-4612

Cross-site scripting (XSS) vulnerability in the keywords manager (keywordmgr.php) in Coppermine Photo Gallery before 1.5.27 and 1.6.x before 1.6.01 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

MEDIUM 6.1EPSS 1.30%

Does this matter?

Lower severity and a low EPSS score (1.30%). Track it; it rarely justifies an emergency change on its own.

Description

CVSS 3.0: 6.1 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS: 1.30% probability · 69th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: coppermine-gallery/coppermine photo gallery
Source: cve@mitre.org

References

http://forum.coppermine-gallery.net/index.php/topic%2C77376.0.html
http://seclists.org/oss-sec/2014/q2/608Mailing List, Patch, Third Party Advisory
http://seclists.org/oss-sec/2014/q2/620Mailing List, Third Party Advisory
http://sourceforge.net/p/coppermine/code/8674Patch
http://www.securityfocus.com/bid/68140Third Party Advisory, VDB Entry
https://sourceforge.net/p/coppermine/code/8674/tree//trunk/cpg1.5.x/CHANGELOG.txtRelease Notes
https://sourceforge.net/p/coppermine/code/8674/tree//trunk/cpg1.6.x/CHANGELOG.txtRelease Notes
http://forum.coppermine-gallery.net/index.php/topic%2C77376.0.html
http://seclists.org/oss-sec/2014/q2/608Mailing List, Patch, Third Party Advisory
http://seclists.org/oss-sec/2014/q2/620Mailing List, Third Party Advisory
http://sourceforge.net/p/coppermine/code/8674Patch
http://www.securityfocus.com/bid/68140Third Party Advisory, VDB Entry
https://sourceforge.net/p/coppermine/code/8674/tree//trunk/cpg1.5.x/CHANGELOG.txtRelease Notes
https://sourceforge.net/p/coppermine/code/8674/tree//trunk/cpg1.6.x/CHANGELOG.txtRelease Notes

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.