CVE-2013-2241 - modules/gallery/helpers/data_rest.php in Gallery 3 before 3.0.9 allows remote attackers to bypass intended access restrictions and obtain sensitive information (image files) via the "full" string in the size parameter

Back Back to CVE browser

MEDIUM

modules/gallery/helpers/data_rest.php in Gallery 3 before 3.0.9 allows remote attackers to bypass intended access restrictions and obtain sensitive information (image files) via the "full" string in the size parameter

Published Oct 10, 2013

5.0

MEDIUM

CVSS 2.0

EPSS 1.57%

Description

modules/gallery/helpers/data_rest.php in Gallery 3 before 3.0.9 allows remote attackers to bypass intended access restrictions and obtain sensitive information (image files) via the "full" string in the size parameter.

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-264

References (7)

http://galleryproject.org/gallery_3_0_9
x_refsource_MISCPatchVendor Advisory
http://sourceforge.net/apps/trac/gallery/ticket/2074
x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2013/07/04/11
mailing-listx_refsource_MLIST
http://www.openwall.com/lists/oss-security/2013/07/05/3
mailing-listx_refsource_MLIST
https://bugzilla.redhat.com/show_bug.cgi?id=981198
x_refsource_CONFIRM
https://euvd.enisa.europa.eu/vulnerability/EUVD-2013-2192
Advisory
https://github.com/gallery/gallery3/commit/cbbcf1b4791762d7da0ea7b6c4f4b551a4d9caed
x_refsource_CONFIRM

Link	Providers	Tags
http://galleryproject.org/gallery_3_0_9		x_refsource_MISCPatchVendor Advisory
http://sourceforge.net/apps/trac/gallery/ticket/2074		x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2013/07/04/11		mailing-listx_refsource_MLIST
http://www.openwall.com/lists/oss-security/2013/07/05/3		mailing-listx_refsource_MLIST
https://bugzilla.redhat.com/show_bug.cgi?id=981198		x_refsource_CONFIRM
https://euvd.enisa.europa.eu/vulnerability/EUVD-2013-2192		Advisory
https://github.com/gallery/gallery3/commit/cbbcf1b4791762d7da0ea7b6c4f4b551a4d9caed		x_refsource_CONFIRM