CVE-2013-2138

2013-10-1000:00:00

ubuntu.com

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

0.016

Percentile

87.6%

JSON

The (1) uploadify and (2) flowplayer SWF files in Gallery 3 before 3.0.8 do
not properly remove query parameters and fragments, which allows remote
attackers to have an unspecified impact via a replay attack.

Notes

Author	Note
seth-arnold	our versions of gallery and gallery2 do not have the swf files, and other packages with uploadify don’t appear to have the same issue on first inspection