Description
PhpWebGallery 1.7.0 and 1.7.1 allows remote authenticated users with advisor privileges to obtain the real e-mail addresses of other users by editing the user's profile.
References
- phpwebgallery-adviser-info-disclosure(44101) vdb-entry
- 30431 vdb-entry
- 31232 third-party-advisory
- http://bugs.phpwebgallery.net/view.php?id=769
- http://forum.phpwebgallery.net/viewtopic.php?id=13545
- [oss-security] 20080801 Re: CVE request: phpwebgallery < 1.7.2 mailing-list