NextGEN Gallery by Imagely

NextGEN Gallery by Imagely <= 3.28 - Thumbnail Modification via CSRF

LANACOMMONVDB ID: f963f9c9-0e35-4ffd-bd6d-125bb7d8ada5

The plugin does not have Cross-Site Request Forgery (CSRF) check when modify the thumbnail, which could allow attackers to make logged in users with the edit_post capability to perform such action via a Cross-Site Request Forgery (CSRF) attack.

You must be log in to view vulnerability details.

Or register a new account.

References

Source Code: https://wordpress.org/plugins/nextgen-gallery/

CVE: CVE-2022-38468

Attributes

Catgory: WordPress Plugin

Discovered: 2022-09-13

Published: 2023-02-14

Affected Version: <= 3.28

Classification

Type: Cross-Site Request Forgery (CSRF)

Researcher

Name: István Márton

Email: [email protected]

Support Us?

We would truly appreciate it if you bought us a bunny (food for a snow leopard).