Re: Gallery v1.3.3 Cross Site Scripting Vulnerabillity
From: "The-Insider" <nuritrv18@xxxxxxxxxxxx>
...
> #######################################################################
>
> Application: Gallery
> Vendors:
> http://gallery.sourceforge.net
> http://gallery.menalto.com
> Versions: <= 1.3.3
> Platforms: Windows/Unix
> Bug: Cross Site Scripting Vulnerabillity
> Risk: Low
> Exploitation: Remote with browser
> Date: 30 Dec 2003
> Author: Rafel Ivgi, The-Insider
> e-mail: the_insider@xxxxxxxx
> web: http://theinsider.deep-ice.com
5 points for finding a security flaw. -500 for not contacting us first,
because then we could
have told you that this flaw was fixed in Gallery v1.3.4-pl1, released July
27 2002 and
you could have included that information in your security advisory.
For complete details on the bug and the bug fix, including a patch, please
read
this story on our web site:
http://gallery.menalto.com/modules.php?op=modload&name=News&file=article&sid=82
By the way, this bug affects all versions of Gallery from v1.1 to v1.3.4 so
if you're running
one of those versions of Gallery we strongly advise you to either apply the
patch in the
above news story, or upgrade to the latest version of Gallery from here:
http://gallery.sf.net/download.php
-Bharat
Gallery Project Lead