Cross-site scripting (XSS) vulnerability in Menalto Gallery before 2.2.5 allows remote attackers to inject arbitrary web script or HTML via the (1) host and (2) path components of a URL.

- Wed Jun 18 2008 John Berninger <john at ncphotography     dot com> - 2.2.5-1

    - update to upstream 2.2.5 for security vulns

    - Tue Apr 22 2008 John Berninger <john at ncphotography       dot com> - 2.2.4-4

    - update version for tag conflict due to devel build       prior to update of cvs checkout

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Wed Jun 18 2008 John Berninger <john at ncphotography     dot com> - 2.2.5-1

    - update to upstream 2.2.5 for security vulns

    - Thu Mar 20 2008 John Berninger <john at ncphotography       dot com> - 2.2.4-3

    - revert to SVN snapshot so that config-time integrity       checks don't fail

    - remove embedded copy of smarty and use php-Smarty       package

    - Sat Dec 29 2007 John Berninger <john at ncphotography       dot com) - 2.2.4-2

    - BZ 279961 - allow FileInfo

    - Mon Dec 24 2007 Lubomir Kundrak <lkundrak at       redhat.com> 2.2.4-1

    - A christmas present -- critical security update to       2.2.4

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running Gallery, a web-based photo album application written in PHP.  The version of Gallery installed on the remote host is less than 2.2.5.  The vendor has reported multiple security flaws in this version.   The software is prone to a cross-site scripting flaw which could allow an attacker to execute arbitrary script code within client browsers.  The software is prone to an information disclosure flaw within the 'album-select' module and the 'embed.php' script which would allow an attacker to gain access to confidential data.  The software is prone to a privilege escalation flaw which would allow users the ability to gain access to confidential files or processes.   Finally, the software is vulnerable to a security bypass flaw which would allow an attacker the ability to view confidential data.

ID	Name	Product	Family	Severity
33238	Fedora 9 : gallery2-2.2.5-1.fc9 (2008-5576)	Nessus	Fedora Local Security Checks	high
33236	Fedora 8 : gallery2-2.2.5-1.fc8 (2008-5479)	Nessus	Fedora Local Security Checks	high
4540	Gallery < 2.2.4 Multiple Vulnerabilities	Nessus Network Monitor	CGI	high

Detections

Analytics

CVE-2008-2720

medium

Tenable Plugins

high

high

high