CVE-2005-3979

relocate_server.php in Coppermine Photo Gallery (CPG) 1.4.2 and 1.4 beta is not removed after installation and does not use authentication, which allows remote attackers to obtain sensitive information, such as database configuration, via a direct request.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://coppermine-gallery.net/forum/index.php?topic=24217.0	Vendor Advisory
http://secunia.com/advisories/17855	Permissions Required Third Party Advisory
http://www.vupen.com/english/advisories/2005/2698	Permissions Required Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:coppermine-gallery:coppermine_photo_gallery:1.4:beta::::::
	cpe:2.3:a:coppermine-gallery:coppermine_photo_gallery:1.4.2:::::::*

History

No history.

Information

Published : 2005-12-03 19:03

Updated : 2023-12-10 10:28

NVD link : CVE-2005-3979

Mitre link : CVE-2005-3979

CVE.ORG link : CVE-2005-3979

JSON object : View

Products Affected

coppermine-gallery

coppermine_photo_gallery

CWE

CWE-287

Improper Authentication

{"id": "CVE-2005-3979", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2005-12-03T19:03:00.000", "references": [{"url": "http://coppermine-gallery.net/forum/index.php?topic=24217.0", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/17855", "tags": ["Permissions Required", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2005/2698", "tags": ["Permissions Required", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "relocate_server.php in Coppermine Photo Gallery (CPG) 1.4.2 and 1.4 beta is not removed after installation and does not use authentication, which allows remote attackers to obtain sensitive information, such as database configuration, via a direct request."}, {"lang": "es", "value": "relocate_server.php en Coppermine Photo Gallery (CPG) 1.4.2 y 1.4 beta no se elimina despu\u00e9s de la instalaci\u00f3n y no usa autenticaci\u00f3n, lo que permite a atacantes remotos obtener informaci\u00f3n sensible, como la configuraci\u00f3n de la base de datos, a trav\u00e9s de una petici\u00f3n directa."}], "lastModified": "2019-07-16T19:37:18.437", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:coppermine-gallery:coppermine_photo_gallery:1.4:beta:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "60C520A7-686D-40AB-A41B-EDDF3EC86819"}, {"criteria": "cpe:2.3:a:coppermine-gallery:coppermine_photo_gallery:1.4.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A3BF818D-86E5-4886-9447-FE70CBEAEA0B"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}