CVE-2013-2240

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2013-10-10 · updated 2026-06-16

Description

lib/flowplayer.swf.php in Gallery 3 before 3.0.9 does not properly remove query fragments, which allows remote attackers to have an unspecified impact via a replay attack, a different vulnerability than CVE-2013-2138.

Affected products

Menalto Gallery: 3.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5 (+3)

References

http://galleryproject.org/gallery_3_0_9
http://sourceforge.net/apps/trac/gallery/ticket/2073
http://www.openwall.com/lists/oss-security/2013/07/04/11
https://bugzilla.redhat.com/show_bug.cgi?id=981197
https://github.com/gallery/gallery3/commit/c5318bb1a2dd266b50317a2adb74d74338593733
http://galleryproject.org/gallery_3_0_9
http://sourceforge.net/apps/trac/gallery/ticket/2073
http://www.openwall.com/lists/oss-security/2013/07/04/11
https://bugzilla.redhat.com/show_bug.cgi?id=981197
https://github.com/gallery/gallery3/commit/c5318bb1a2dd266b50317a2adb74d74338593733

Get alerted when CVE-2013-2240 or the next vulnerability affects your stack