Description
The (1) uploadify and (2) flowplayer SWF files in Gallery 3 before 3.0.8 do not properly remove query parameters and fragments, which allows remote attackers to have an unspecified impact via a replay attack.
References (7)
Core 7
Core References
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=970596
Patch x_refsource_confirm
https://github.com/gallery/gallery3/commit/3e5bba2cd4febe8331c0158c11ea418f21c72efa
Vendor Advisory x_refsource_misc
http://galleryproject.org/gallery_3_0_8
Mailing List mailing-list
x_refsource_mlist
http://www.openwall.com/lists/oss-security/2013/06/04/9
Patch x_refsource_confirm
https://github.com/gallery/gallery3/commit/80bb0f2222dd99ed2ce59e804b833bab63cc376a
Product x_refsource_confirm
http://sourceforge.net/apps/trac/gallery/ticket/2070
Product x_refsource_confirm
http://sourceforge.net/apps/trac/gallery/ticket/2068
Scores
EPSS
0.0121
EPSS Percentile
79.1%
Details
CWE
CWE-20
Status
published
Products (8)
menalto/gallery
3.0 (6 CPE variants)
menalto/gallery
3.0.1
menalto/gallery
3.0.2
menalto/gallery
3.0.3
menalto/gallery
3.0.4
menalto/gallery
3.0.5
menalto/gallery
3.0.6
menalto/gallery
< 3.0.7
Published
Oct 10, 2013
Tracked Since
Feb 18, 2026