CVE-2023-3279

NextGEN Gallery < 3.39 - Admin+ Local File Inclusion

Medium · published October 16, 2023

CVSS v3.1
4.9
EPSS
1%
Percentile
61.2
In the wild
Unconfirmed
What it is

The WordPress Gallery Plugin WordPress plugin before 3.39 does not validate some block attributes before using them to generate paths passed to include function/s, allowing Admin users to perform LFI attacks

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00960 · 61.2th percentile
Published
2023-10-16T19:39Z
EPSS history
Timeline
  • 16 OCT 19:39Z
    NextGEN Gallery < 3.39 - Admin+ Local File Inclusion
    cvelistv5