Lucene search

PatchstackCVE-2024-37442

HistoryJul 09, 2024 - 11:15 a.m.

CVE-2024-37442

2024-07-0911:15:14

CWE-74

Patchstack

web.nvd.nist.gov

cve-2024-37442

injection

vulnerability

photo gallery by ays

CVSS3

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L

AI Score

4.5

Confidence

High

EPSS

0.001

Percentile

16.8%

JSON

Improper Neutralization of Special Elements in Output Used by a Downstream Component (‘Injection’) vulnerability in Photo Gallery Team Photo Gallery by Ays allows Code Injection.This issue affects Photo Gallery by Ays: from n/a before 5.7.1.

Affected configurations

Nvd

Vulners

Node

ays-prophoto_galleryRange<5.7.1wordpress

VendorProductVersionCPE
ays-prophoto_gallery*cpe:2.3:a:ays-pro:photo_gallery:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
ays-pro	photo_gallery	*	cpe:2.3:a:ays-pro:photo_gallery::::::wordpress::*

CNA Affected

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "gallery-photo-gallery",
    "product": "Photo Gallery by Ays",
    "vendor": "Photo Gallery Team",
    "versions": [
      {
        "changes": [
          {
            "at": "5.7.1",
            "status": "unaffected"
          }
        ],
        "lessThan": "5.7.1",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/gallery-photo-gallery/wordpress-photo-gallery-by-ays-responsive-image-gallery-plugin-5-7-1-html-injection-vulnerability?_s_id=cve

CVSS3

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L

AI Score

4.5

Confidence

High

EPSS

0.001

Percentile

16.8%

JSON

Related for CVE-2024-37442