Auth bypass in Coppermine-Gallery Coppermine Photo Gallery

CVE-2005-3979

relocate_server.php in Coppermine Photo Gallery (CPG) 1.4.2 and 1.4 beta is not removed after installation and does not use authentication, which allows remote attackers to obtain sensitive information, such as database configuration, via a direct request.

Vulnerability class: Broken Authentication

EPSS: 0.016 (72.6th percentile) — read the EPSS interpretation.

Affected products

Coppermine-gallery Coppermine_photo_gallery — versions 1.4, 1.4.2
N/a — versions n/a

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

cve@mitre.org (Permissions Required, x_refsource_SECUNIA, Third Party Advisory, third-party-advisory)
cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)
cve@mitre.org (Permissions Required, Third Party Advisory, vdb-entry, x_refsource_VUPEN)