CVE-2015-1785: imagely nextgen_gallery Cross-Site Request Forgery (CSRF)
Vulnerability summary
CVE-2015-1785 is a high (CVSS 8.8) Cross-Site Request Forgery (CSRF) vulnerability in imagely nextgen_gallery. EPSS estimates a 0.70% chance of exploitation in the next 30 days, higher than 52.4% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 07-07-2022PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain full access over the web application. The vulnerabilities lie in how the application validates user uploaded files and lack of security measures preventing unwanted HTTP requests.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NDiffers
EPSS trend
Probability
0.70%
Chance of exploitation in the next 30 days
Percentile
52%
Versus all other CVEs
30-day change
+0.01 pp
From 0.69% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (blog.nettitude.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
- CWE-434Unrestricted Upload of File with Dangerous TypeThe product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Affected systems
Imagely1 product
- nextgen_gallery< 2.0.77.3
Wordpress1 product
- nextgen-gallery< 2.0.77.3
2 vendors · 2 products
References
3 links- blog.nettitude.com/uk/crsf-and-unsafe-arbitrary-file-upload-in-nextgen-gallery-plugin-for-wordpressX Refsource MISCExploitThird Party Advisory