PT-2007-7095 · S9Y · S9Y Serendipity

Publicado 2007-12-11 · Atualizado 2018-10-15 · CVE-2007-6205

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions S9Y Serendipity versions prior to 1.2.1

Description A cross-site scripting issue exists, allowing remote attackers to inject arbitrary web script or HTML via a link in an RSS feed. This is related to the remote RSS sidebar plugin.

Recommendations For versions prior to 1.2.1, update to version 1.2.1 or later to resolve the issue. As a temporary workaround, consider disabling the remote RSS sidebar plugin until a patch is available.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2007-6205

DSA-1528-1

Produtos afetados

S9Y Serendipity

Referências · 13

• 🔥 http://int21.de/cve/CVE-2007-6205-s9y.html · Exploit
• http://osvdb.org/39143 · Nota
• http://securityreason.com/securityalert/3437 · Nota
• http://debian.org/security/2008/dsa-1528 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6205 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-6205 · Nota de Segurança
• http://secunia.com/advisories/28012 · Aviso do Fabricante
• http://vupen.com/english/advisories/2007/4171 · Nota
• http://secunia.com/advisories/29502 · Nota
• http://securityfocus.com/bid/26783 · Correção
• http://blog.s9y.org/archives/187-Serendipity-1.2.1-released.html · Nota
• http://securityfocus.com/archive/1/484800/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/38947 · Nota