CVE-2014-2558 (GCVE-0-2014-2558)

Vulnerability from cvelistv5 – Published: 2014-05-06 14:00 – Updated: 2024-08-06 10:21
VLAI
Summary
The File Gallery plugin before 1.7.9.2 for WordPress does not properly escape strings, which allows remote administrators to execute arbitrary PHP code via a \' (backslash quote) in the setting fields to /wp-admin/options-media.php, related to the create_function function.
Severity
No CVSS data available.
CWE
  • n/a
Assigner
References
Date Public
2014-04-29 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T10:21:34.678Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://wordpress.org/plugins/file-gallery/changelog/"
          },
          {
            "name": "67120",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/67120"
          },
          {
            "name": "20140429 Arbitrary code execution by admins in File Gallery 1.7.7 (WordPress plugin)",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2014/Apr/305"
          },
          {
            "name": "67183",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/67183"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-04-29T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The File Gallery plugin before 1.7.9.2 for WordPress does not properly escape strings, which allows remote administrators to execute arbitrary PHP code via a \\\u0027 (backslash quote) in the setting fields to /wp-admin/options-media.php, related to the create_function function."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2014-05-06T12:57:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://wordpress.org/plugins/file-gallery/changelog/"
        },
        {
          "name": "67120",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/67120"
        },
        {
          "name": "20140429 Arbitrary code execution by admins in File Gallery 1.7.7 (WordPress plugin)",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2014/Apr/305"
        },
        {
          "name": "67183",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/67183"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2014-2558",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The File Gallery plugin before 1.7.9.2 for WordPress does not properly escape strings, which allows remote administrators to execute arbitrary PHP code via a \\\u0027 (backslash quote) in the setting fields to /wp-admin/options-media.php, related to the create_function function."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://wordpress.org/plugins/file-gallery/changelog/",
              "refsource": "MISC",
              "url": "http://wordpress.org/plugins/file-gallery/changelog/"
            },
            {
              "name": "67120",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/67120"
            },
            {
              "name": "20140429 Arbitrary code execution by admins in File Gallery 1.7.7 (WordPress plugin)",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2014/Apr/305"
            },
            {
              "name": "67183",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/67183"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2014-2558",
    "datePublished": "2014-05-06T14:00:00.000Z",
    "dateReserved": "2014-03-19T00:00:00.000Z",
    "dateUpdated": "2024-08-06T10:21:34.678Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2014-2558",
      "date": "2026-06-15",
      "epss": "0.01746",
      "percentile": "0.74791"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:*:*:*:*:*:wordpress:*:*\", \"versionEndIncluding\": \"1.7.9\", \"matchCriteriaId\": \"B68E2A63-623A-436B-B262-C5B850D9CEC7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.1:*:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"AF58CB15-536B-4485-B5BC-DAC12698C711\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.2:*:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"2AD0033F-7EB7-4A5B-9560-7B672963B885\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.3:*:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"9CE8AA8B-769D-4339-B51E-DC4F91C56A94\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.4:*:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"DA149601-A2ED-4BB8-8DAC-7234679B2AAD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.5:*:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"E3E4DA99-306F-4A60-8449-87EABDAB5F12\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.5:a:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"6F1C54AA-0377-49CF-B4D6-655A2EF3E648\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.5:b:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"D9475240-7B0D-406D-8D2E-DE23C76ABB84\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.5:b2:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"82132E15-FB4D-4F52-93AA-47318206DAC0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.5:b3:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"8A171A71-4AC6-4717-B54D-5AAC59039BEE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.5:rc1:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"9242D53C-5258-4204-9022-0D8DB1EA3934\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.5.1:*:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"4089F04C-255E-4D1A-B6F5-6757B9282826\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.5.2:*:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"34E28E0C-BC99-41FF-B8F8-E64929BB3598\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.5.3:*:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"26B95CB6-153C-4616-9811-B17F40D6357C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.5.4:*:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"EC401079-6980-43CD-BF8F-DDE2161B1EA4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.5.5:*:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"6F7B65A9-56F0-4B72-A9F6-7AA490637C3D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.5.6:*:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"C2E213C9-E831-44B3-8599-BCE6E64F8C97\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.5.7:*:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"859DE07F-6947-4C3F-9004-9F4A2DB40BC3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.5.8:-:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"12B72E15-9D11-4CA6-92CA-E86B423242FD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.5.8:b1:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"9512BEB9-26A1-4428-8ACE-F10FE57CE9E3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.5.8:b2:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"992A1059-E3D2-41DE-8B2D-3B99C5132D69\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.5.9:*:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"4A1A5B3D-3868-41F4-8D0F-A36EFA425121\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.6:*:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"6E51AC25-7047-4DFB-B949-49F39D1B3C15\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.6.0.1:*:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"77B4A67F-5144-4E3F-AB6B-D36760AAFEA7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.6.2:*:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"98B23279-BD2D-40CF-BFD8-8D945AE9934C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.6.3:*:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"FAF2D9B3-7DB9-4EF5-8018-6FE26EA2864F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.6.4:*:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"AC320AA7-33B4-40D1-97B0-99D065535E58\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.6.4.1:*:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"9364A096-2B2D-4403-8850-75525B583635\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.6.5:*:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"6A93DC23-4D82-4C5E-AF98-15F60C31E7DB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.6.5.1:*:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"EBFF70FD-9D98-4E0E-BEF3-AF06ADFBF025\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.6.5.2:*:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"486E575D-FFA7-45EF-A31A-A5FC26E68AC8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.6.5.3:*:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"6E025600-7048-4254-B626-D9F649D39C12\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.6.5.4:*:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"ABD67520-9D03-4AAE-8EAA-2CC3540CAEA4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.6.5.5:*:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"070163E5-6582-4475-BAFF-E2531E2D89CB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.6.5.6:*:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"D8531A96-1428-45BD-91BA-BB4D04850E7C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.6.6:beta:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"4261DF6C-D6E7-4F3D-A66D-9221FE02B633\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.7:-:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"99C448D8-ACDB-44A0-8C17-C1AC416A9FC9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.7:rc10:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"ADB81F63-ED94-47B3-B285-10F4CDF3B45E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.7:rc11:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"40F1C6BD-8268-4AEC-8FAC-24162BF981D4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.7:rc12:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"7DD90BB2-4242-483D-9818-5AF8684319A0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.7:rc13:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"308FD8F6-A30C-4024-9667-5FA560DBFB83\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.7:rc14:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"31542CAA-5B4E-4E1B-AB25-60C5CC299DA6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.7:rc3:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"7DE9DEDA-18F1-4FE9-85D4-30D67AD7BB77\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.7:rc4:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"DAA8CCB7-6A41-4D24-8748-BE3E6E1121DA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.7:rc5:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"02B08C9C-B340-49B1-A69C-A8A3F85E2211\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.7:rc6:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"FFFEC765-88C2-4151-92C8-CDCC9CFE2908\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.7:rc7:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"42EB8144-F2C2-449B-AE94-4155ADCB0C32\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.7:rc8:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"81B83688-BB06-46BB-ACD3-97FDA26BB2A9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.7:rc9:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"720BD335-4ED5-43D2-8D9B-9222BBDAEDB4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.7.1:*:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"93454615-3C45-40D1-9C8B-5823D7099F30\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.7.2:*:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"AA440FDF-2375-4F4E-9005-0606A66804DB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.7.3:*:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"01700FA8-928B-4346-B6D0-6D560B7EB76B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.7.4:-:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"10BFDCCC-56CD-440B-A425-F4EF8A9635E5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.7.4:rc2:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"911975C3-47BE-46AC-976F-7D7E5471F929\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.7.4.1:*:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"C39EA776-E308-4E8F-B452-1A8172CBBF67\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.7.5:-:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"697D80E3-FA33-4B71-81A3-8C8C56D1AC15\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.7.5:beta1:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"19958EF8-99A4-4143-9929-DE0C43D6F5CC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.7.5:beta2:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"96F45A71-2219-4E1A-8CF6-A72E51FE2E9F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.7.5.1:*:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"C9C1F30A-6265-405B-AAF8-A34D5A91C1B1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.7.5.3:*:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"BEAAAB83-E8C0-4BA4-8BE7-1E9F132892F8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.7.6:*:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"DBFEC6DC-5652-4E25-A2FD-CF1539E1B88D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.7.7:*:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"A3AB4A72-7323-450F-97C6-9310F293AC08\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:skyphe:file-gallery:1.7.8:*:*:*:*:wordpress:*:*\", \"matchCriteriaId\": \"1B331237-29BD-40B4-A0EF-3033E1BF8219\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"The File Gallery plugin before 1.7.9.2 for WordPress does not properly escape strings, which allows remote administrators to execute arbitrary PHP code via a \\\\\u0027 (backslash quote) in the setting fields to /wp-admin/options-media.php, related to the create_function function.\"}, {\"lang\": \"es\", \"value\": \"El plugin File Gallery anterior a 1.7.9.2 para WordPress no escapa debidamente cadenas, lo que permite a administradores remotos ejecutar c\\u00f3digo PHP arbitrario a trav\\u00e9s de un \\\\\u0027 (barra invertida comilla) en los campos de configuraci\\u00f3n hacia /wp-admin/options-media.php, relacionado con la funci\\u00f3n create_function.\"}]",
      "id": "CVE-2014-2558",
      "lastModified": "2024-11-21T02:06:31.817",
      "metrics": "{\"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:S/C:P/I:P/A:P\", \"baseScore\": 6.5, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"SINGLE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.0, \"impactScore\": 6.4, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2014-05-06T14:55:05.697",
      "references": "[{\"url\": \"http://seclists.org/fulldisclosure/2014/Apr/305\", \"source\": \"cve@mitre.org\", \"tags\": [\"Exploit\"]}, {\"url\": \"http://wordpress.org/plugins/file-gallery/changelog/\", \"source\": \"cve@mitre.org\", \"tags\": [\"Patch\"]}, {\"url\": \"http://www.securityfocus.com/bid/67120\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.securityfocus.com/bid/67183\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://seclists.org/fulldisclosure/2014/Apr/305\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\"]}, {\"url\": \"http://wordpress.org/plugins/file-gallery/changelog/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"http://www.securityfocus.com/bid/67120\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.securityfocus.com/bid/67183\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-94\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2014-2558\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2014-05-06T14:55:05.697\",\"lastModified\":\"2026-05-06T22:30:45.220\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The File Gallery plugin before 1.7.9.2 for WordPress does not properly escape strings, which allows remote administrators to execute arbitrary PHP code via a \\\\\u0027 (backslash quote) in the setting fields to /wp-admin/options-media.php, related to the create_function function.\"},{\"lang\":\"es\",\"value\":\"El plugin File Gallery anterior a 1.7.9.2 para WordPress no escapa debidamente cadenas, lo que permite a administradores remotos ejecutar c\u00f3digo PHP arbitrario a trav\u00e9s de un \\\\\u0027 (barra invertida comilla) en los campos de configuraci\u00f3n hacia /wp-admin/options-media.php, relacionado con la funci\u00f3n create_function.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:P/I:P/A:P\",\"baseScore\":6.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.0,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-94\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:*:*:*:*:*:wordpress:*:*\",\"versionEndIncluding\":\"1.7.9\",\"matchCriteriaId\":\"B68E2A63-623A-436B-B262-C5B850D9CEC7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.1:*:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"AF58CB15-536B-4485-B5BC-DAC12698C711\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.2:*:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"2AD0033F-7EB7-4A5B-9560-7B672963B885\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.3:*:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"9CE8AA8B-769D-4339-B51E-DC4F91C56A94\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.4:*:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"DA149601-A2ED-4BB8-8DAC-7234679B2AAD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.5:*:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"E3E4DA99-306F-4A60-8449-87EABDAB5F12\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.5:a:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"6F1C54AA-0377-49CF-B4D6-655A2EF3E648\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.5:b:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"D9475240-7B0D-406D-8D2E-DE23C76ABB84\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.5:b2:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"82132E15-FB4D-4F52-93AA-47318206DAC0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.5:b3:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"8A171A71-4AC6-4717-B54D-5AAC59039BEE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.5:rc1:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"9242D53C-5258-4204-9022-0D8DB1EA3934\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.5.1:*:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"4089F04C-255E-4D1A-B6F5-6757B9282826\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.5.2:*:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"34E28E0C-BC99-41FF-B8F8-E64929BB3598\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.5.3:*:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"26B95CB6-153C-4616-9811-B17F40D6357C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.5.4:*:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"EC401079-6980-43CD-BF8F-DDE2161B1EA4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.5.5:*:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"6F7B65A9-56F0-4B72-A9F6-7AA490637C3D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.5.6:*:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"C2E213C9-E831-44B3-8599-BCE6E64F8C97\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.5.7:*:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"859DE07F-6947-4C3F-9004-9F4A2DB40BC3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.5.8:-:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"12B72E15-9D11-4CA6-92CA-E86B423242FD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.5.8:b1:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"9512BEB9-26A1-4428-8ACE-F10FE57CE9E3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.5.8:b2:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"992A1059-E3D2-41DE-8B2D-3B99C5132D69\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.5.9:*:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"4A1A5B3D-3868-41F4-8D0F-A36EFA425121\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.6:*:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"6E51AC25-7047-4DFB-B949-49F39D1B3C15\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.6.0.1:*:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"77B4A67F-5144-4E3F-AB6B-D36760AAFEA7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.6.2:*:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"98B23279-BD2D-40CF-BFD8-8D945AE9934C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.6.3:*:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"FAF2D9B3-7DB9-4EF5-8018-6FE26EA2864F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.6.4:*:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"AC320AA7-33B4-40D1-97B0-99D065535E58\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.6.4.1:*:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"9364A096-2B2D-4403-8850-75525B583635\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.6.5:*:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"6A93DC23-4D82-4C5E-AF98-15F60C31E7DB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.6.5.1:*:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"EBFF70FD-9D98-4E0E-BEF3-AF06ADFBF025\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.6.5.2:*:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"486E575D-FFA7-45EF-A31A-A5FC26E68AC8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.6.5.3:*:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"6E025600-7048-4254-B626-D9F649D39C12\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.6.5.4:*:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"ABD67520-9D03-4AAE-8EAA-2CC3540CAEA4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.6.5.5:*:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"070163E5-6582-4475-BAFF-E2531E2D89CB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.6.5.6:*:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"D8531A96-1428-45BD-91BA-BB4D04850E7C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.6.6:beta:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"4261DF6C-D6E7-4F3D-A66D-9221FE02B633\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.7:-:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"99C448D8-ACDB-44A0-8C17-C1AC416A9FC9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.7:rc10:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"ADB81F63-ED94-47B3-B285-10F4CDF3B45E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.7:rc11:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"40F1C6BD-8268-4AEC-8FAC-24162BF981D4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.7:rc12:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"7DD90BB2-4242-483D-9818-5AF8684319A0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.7:rc13:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"308FD8F6-A30C-4024-9667-5FA560DBFB83\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.7:rc14:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"31542CAA-5B4E-4E1B-AB25-60C5CC299DA6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.7:rc3:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"7DE9DEDA-18F1-4FE9-85D4-30D67AD7BB77\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.7:rc4:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"DAA8CCB7-6A41-4D24-8748-BE3E6E1121DA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.7:rc5:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"02B08C9C-B340-49B1-A69C-A8A3F85E2211\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.7:rc6:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"FFFEC765-88C2-4151-92C8-CDCC9CFE2908\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.7:rc7:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"42EB8144-F2C2-449B-AE94-4155ADCB0C32\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.7:rc8:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"81B83688-BB06-46BB-ACD3-97FDA26BB2A9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.7:rc9:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"720BD335-4ED5-43D2-8D9B-9222BBDAEDB4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.7.1:*:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"93454615-3C45-40D1-9C8B-5823D7099F30\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.7.2:*:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"AA440FDF-2375-4F4E-9005-0606A66804DB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.7.3:*:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"01700FA8-928B-4346-B6D0-6D560B7EB76B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.7.4:-:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"10BFDCCC-56CD-440B-A425-F4EF8A9635E5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.7.4:rc2:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"911975C3-47BE-46AC-976F-7D7E5471F929\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.7.4.1:*:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"C39EA776-E308-4E8F-B452-1A8172CBBF67\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.7.5:-:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"697D80E3-FA33-4B71-81A3-8C8C56D1AC15\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.7.5:beta1:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"19958EF8-99A4-4143-9929-DE0C43D6F5CC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.7.5:beta2:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"96F45A71-2219-4E1A-8CF6-A72E51FE2E9F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.7.5.1:*:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"C9C1F30A-6265-405B-AAF8-A34D5A91C1B1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.7.5.3:*:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"BEAAAB83-E8C0-4BA4-8BE7-1E9F132892F8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.7.6:*:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"DBFEC6DC-5652-4E25-A2FD-CF1539E1B88D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.7.7:*:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"A3AB4A72-7323-450F-97C6-9310F293AC08\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:skyphe:file-gallery:1.7.8:*:*:*:*:wordpress:*:*\",\"matchCriteriaId\":\"1B331237-29BD-40B4-A0EF-3033E1BF8219\"}]}]}],\"references\":[{\"url\":\"http://seclists.org/fulldisclosure/2014/Apr/305\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\"]},{\"url\":\"http://wordpress.org/plugins/file-gallery/changelog/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\"]},{\"url\":\"http://www.securityfocus.com/bid/67120\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/bid/67183\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://seclists.org/fulldisclosure/2014/Apr/305\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\"]},{\"url\":\"http://wordpress.org/plugins/file-gallery/changelog/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"http://www.securityfocus.com/bid/67120\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/bid/67183\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.