CVE-2005-3477: XSS
Multiple interpretation error in the image upload handling code in Invision Gallery 2.0.3 allows remote attackers to conduct cross-site scripting (XSS) attacks via HTML or script in an image whose type does not match its extension, which is rendered by Internet Explorer due to CVE-2005-3312. NOTE: it could be argued that this vulnerability is due to a design flaw in Internet Explorer and the proper fix should be in that browser; if so, then this should not be treated as a vulnerability in Invision Gallery.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2005-3477?
CVE-2005-3477 is considered a moderate severity vulnerability due to its potential for cross-site scripting (XSS) attacks.
How do I fix CVE-2005-3477?
To mitigate CVE-2005-3477, update Invision Gallery to the latest version that addresses this vulnerability.
What type of attack is possible with CVE-2005-3477?
CVE-2005-3477 allows remote attackers to conduct cross-site scripting (XSS) attacks.
Which version of Invision Gallery is affected by CVE-2005-3477?
CVE-2005-3477 specifically affects Invision Gallery version 2.0.3.
What is the cause of the vulnerability in CVE-2005-3477?
The vulnerability in CVE-2005-3477 arises from errors in image upload handling that allow mismatched file types to execute scripts.