The (1) uploadify and (2) flowplayer SWF files in Gallery 3 before 3.0.8 do not properly remove query parameters and fragments, which allows remote attackers to have an unspecified impact via a replay attack.

Fixes for CVE-2013-2240, CVE-2013-2241.

A security flaw was found in the way flowplayer SWF file handling functionality of Gallery version 3, an open source project with the goal to develop and support leading photo sharing web application solutions, processed certain URL fragments passed to this file (certain URL fragments were not stripped properly when these files were called via direct URL request(s)). A remote attacker could use this flaw to conduct replay attacks.

Multiple information exposure flaws were found in the way data rest core module of Gallery version 3, an open source project with the goal to develop and support leading photo sharing web application solutions, used to previously restrict access to certain items of the photo album. A remote attacker, valid Gallery 3 user, could use this flaw to possibly obtain sensitive information (file, resize or thumb path of the item in question).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its version number, the Gallery install hosted on the remote web server contains cross-site scripting vulnerabilities in the 'uploadify.swf' and 'flowplay.swf' files, where URL fragments and parameters are not properly sanitized when called via direct requests. An attacker may be able to leverage these issues to inject arbitrary HTML and script code into a user's browser to be executed within the security context of the affected site. 

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
68892	Fedora 17 : gallery3-3.0.9-1.fc17 (2013-12441)	Nessus	Fedora Local Security Checks	high
68891	Fedora 18 : gallery3-3.0.9-1.fc18 (2013-12424)	Nessus	Fedora Local Security Checks	high
68890	Fedora 19 : gallery3-3.0.9-1.fc19 (2013-12384)	Nessus	Fedora Local Security Checks	high
66933	Gallery 3.0.x < 3.0.8 Multiple XSS	Nessus	CGI abuses : XSS	high

Detections

Analytics

CVE-2013-2138

critical

Tenable Plugins

high

high

high

high