CVE-2012-1613

Cross-site scripting (XSS) vulnerability in edit_one_pic.php in Coppermine Photo Gallery before 1.5.20 allows remote authenticated users with certain privileges to inject arbitrary web script or HTML via the keywords parameter.

Score

CVSS 2.0 3.5 Low

Status

Modified - secalert@redhat.com

Published

2012-09-04

Last modified

2024-09-16

Weaknesses

CWE-79

Affected products

• Coppermine Photo Gallery (Coppermine-gallery)

References

• http://archives.neohapsis.com/archives/bugtraq/2012-03/0167.html
• http://coppermine.svn.sourceforge.net/viewvc/coppermine/trunk/cpg1.6.x/edit_one_pic.php?r1=8348&r2=8354
• http://forum.coppermine-gallery.net/index.php/topic%2C74682.0.html
• http://osvdb.org/80731
• http://packetstormsecurity.org/files/111369/Coppermine-1.5.18-Cross-Site-Scripting-Path-Disclosure.html
• http://secunia.com/advisories/48643
• http://www.exploit-db.com/exploits/18680
• http://www.openwall.com/lists/oss-security/2012/03/30/5
• http://www.openwall.com/lists/oss-security/2012/03/30/6
• http://www.openwall.com/lists/oss-security/2012/04/03/6
• http://www.securityfocus.com/bid/52818
• http://www.waraxe.us/advisory-81.html