Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2008-4129

Date: September 18, 2008

Gallery before 1.5.9, and 2.x before 2.2.6, does not properly handle ZIP archives containing symbolic links, which allows remote authenticated users to conduct directory traversal attacks and read arbitrary files via vectors related to the archive upload (aka zip upload) functionality.

Severity Score

Related Resources (13)

http://secunia.com/advisories/32662
https://exchange.xforce.ibmcloud.com/vulnerabilities/45228
https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00832.html
http://www.securityfocus.com/bid/31231
http://secunia.com/advisories/33144
http://gallery.menalto.com/gallery_1.5.9_released
http://secunia.com/advisories/31912
http://gallery.menalto.com/gallery_2.2.6_released
http://security.gentoo.org/glsa/glsa-200811-02.xml
https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00794.html
https://people.canonical.com/~ubuntu-security/cve/CVE-2008-4129
https://nvd.nist.gov/vuln/detail/CVE-2008-4129
https://www.mend.io/vulnerability-database/CVE-2008-4129

Severity Score

Weakness Type (CWE)

Path Traversal

CWE-22

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): LOW
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): LOW
Integrity (I): NONE
Availability (A): NONE

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): LOW
Authentication (AU): SINGLE
Confidentiality (C): PARTIAL
Integrity (I): NONE
Availability (A): NONE
Additional information:

Do you need more information?

Contact Us