VDB
CVE-2008-3486
CVE-2008-3486
PUBLISHED
CVSS 7.5 HIGH
Directory traversal vulnerability in the user_get_profile function in include/functions.inc.php in Coppermine Photo Gallery (CPG) 1.4.18 and earlier, when the charset is utf-8, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang part of serialized data in an _data cookie.
EPSS 6.30% · 93.5th percentile
Risk Scores
CVSS 2.0
7.5
EPSS Score
6.30%
93.5th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
| coppermine-gallery | coppermine_photo_gallery | 0, 1.0, 1.0 |
Timeline
- Jul 31, 2008 PoC Published
- Aug 6, 2008 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- Jul 13, 2022 EPSS Score
- Sep 4, 2022 EPSS Score
- Oct 27, 2022 EPSS Score
- Feb 10, 2023 EPSS Score
- Apr 4, 2023 EPSS Score
- May 27, 2023 EPSS Score
- Sep 9, 2023 EPSS Score
- Nov 1, 2023 EPSS Score
References
- 30480 vdb
- coppermine-lang-file-include(44133) vdb
- 31295 third-party-advisory
- 4108 third-party-advisory
- 6178 exploit
- https://nvd.nist.gov/vuln/detail/CVE-2008-3486 advisory