Re: CVE request: XSS in coppermine gallery before 1.5.28

[cve-assign () mitre org]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> Coppermine Gallery before 1.5.28 contains a Cross Site Scripting
> vulnerability in the file keywordmgr.php.
> http://forum.coppermine-gallery.net/index.php/topic,77376.0.html
> http://sourceforge.net/p/coppermine/code/8674/

> It is important that all users who run version cpg1.5.26 or older
> update to this latest version

> http://sourceforge.net/p/coppermine/code/8674/tree//trunk/cpg1.5.x/CHANGELOG.txt
> Coppermine version: 1.5.27
> 2014-03-11 [S] Fixed XSS issue {eenemeenemuu}

> http://sourceforge.net/p/coppermine/code/8674/tree//trunk/cpg1.6.x/CHANGELOG.txt
> Coppermine version: 1.6.01
> 2014-03-11 [S] Fixed XSS issue {eenemeenemuu}

As far as we can tell, all of this refers to the same vulnerability,
and means that 1.5.27 and 1.6.01 are also fixed versions, but neither
of those versions was recommended for use by any customer.

Use CVE-2014-4612.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJTqRDUAAoJEKllVAevmvmsvl4IAITBbFAsvwmno8wreNsclIKi
zODHgNc6YFkOQiCCUUAG8YGvzNANOFEhClBpHzzCdymf6xjUYLVPZOQ17eh64q7f
8OoYOOME7XRc8Ku3TsXLPhg7GA3SatpBldPLHQWDzDKUIZhJYCdm5szNe0P3aZ+r
rtdAmtWrHMIgRqrj/M4CTlliycWrv8dKnz6X9pMGYwSyRRD5GFBUCB1ajZvvpKkx
ZPZqvSYPIacg9sUNC8amHP4j6Ny2E0CQo0PrH76gcp6MfPhGZARZiX6AXGMTus5C
BE0xkn7SFURmWVhmLSV36LHjQU2rwBarWzlUQvV/YmYpvhpNQpmZPOOpxYjIaR4=
=7VDe
-----END PGP SIGNATURE-----