Lucene search

K
openvasCopyright (C) 2023 Greenbone AGOPENVAS:1361412562310127591
HistoryOct 18, 2023 - 12:00 a.m.

WordPress NextGEN Gallery Plugin < 3.39 Multiple Vulnerabilities

2023-10-1800:00:00
Copyright (C) 2023 Greenbone AG
plugins.openvas.org
2
wordpress
nextgen gallery
vulnerabilities
phar deserialization
arbitrary file read
arbitrary file delete
lfi attacks

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

6.9 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

36.4%

The WordPress plugin

# SPDX-FileCopyrightText: 2023 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:imagely:nextgen_gallery";

if (description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.127591");
  script_version("2023-10-24T05:06:28+0000");
  script_tag(name:"last_modification", value:"2023-10-24 05:06:28 +0000 (Tue, 24 Oct 2023)");
  script_tag(name:"creation_date", value:"2023-10-18 12:10:39 +0000 (Wed, 18 Oct 2023)");
  script_tag(name:"cvss_base", value:"7.8");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:C/I:N/A:N");
  script_tag(name:"severity_vector", value:"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2023-10-19 13:22:00 +0000 (Thu, 19 Oct 2023)");

  script_cve_id("CVE-2023-3154", "CVE-2023-3155", "CVE-2023-3279");

  script_tag(name:"qod_type", value:"remote_banner");

  script_tag(name:"solution_type", value:"VendorFix");

  script_name("WordPress NextGEN Gallery Plugin < 3.39 Multiple Vulnerabilities");

  script_category(ACT_GATHER_INFO);

  script_copyright("Copyright (C) 2023 Greenbone AG");
  script_family("Web application abuses");
  script_dependencies("gb_wordpress_plugin_http_detect.nasl");
  script_mandatory_keys("wordpress/plugin/nextgen-gallery/detected");

  script_tag(name:"summary", value:"The WordPress plugin 'NextGen Gallery' is prone to multiple
  vulnerabilities.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"The following vulnerabilities exist:

  - CVE-2023-3154: The plugin is vulnerable to PHAR Deserialization due to a lack of input
  parameter validation in the `gallery_edit` function, allowing an attacker to access arbitrary
  resources on the server.

  - CVE-2023-3155: The plugin is vulnerable to Arbitrary File Read and Delete due to a lack of
  input parameter validation in the `gallery_edit` function, allowing an attacker to access
  arbitrary resources on the server.

  - CVE-2023-3279: The plugin does not validate some block attributes before using them to generate
  paths passed to include function/s, allowing Admin users to perform LFI attacks.");

  script_tag(name:"affected", value:"WordPress NextGEN Gallery plugin prior to version 3.39.");

  script_tag(name:"solution", value:"Update to version 3.39 or later.");

  script_xref(name:"URL", value:"https://wpscan.com/vulnerability/ed099489-1db4-4b42-9f72-77de39c9e01e/");
  script_xref(name:"URL", value:"https://wpscan.com/vulnerability/5c8473f4-4b52-430b-9140-b81b0a0901da/");
  script_xref(name:"URL", value:"https://wpscan.com/vulnerability/3b7a7070-8d61-4ff8-b003-b4ff06221635/");

  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if( ! port = get_app_port( cpe: CPE ) )
  exit( 0 );

if( ! infos = get_app_version_and_location( cpe: CPE, port: port, exit_no_version: TRUE ) )
  exit( 0 );

version = infos["version"];
location = infos["location"];

if( version_is_less( version: version, test_version: "3.39" ) ) {
  report = report_fixed_ver( installed_version: version, fixed_version: "3.39", install_path: location );
  security_message( port: port, data: report );
  exit( 0 );
}

exit( 99 );

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

6.9 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

36.4%

Related for OPENVAS:1361412562310127591