PT-2008-2969 · S9Y · Serendipity

Hanno Boeck · Publicado 2008-04-23 · Atualizado 2018-10-11 · CVE-2008-1386

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Serendipity (S9Y) version 1.3

Description The issue allows remote attackers to inject arbitrary web script or HTML via unspecified path fields or the database host field, potentially leading to cross-site scripting (XSS) attacks. The timing window for exploitation of this issue might be limited.

Recommendations For Serendipity (S9Y) version 1.3, consider updating to a newer version that addresses the cross-site scripting vulnerabilities, specifically focusing on securing the installer and input validation for path fields and the database host field. As a temporary workaround, restrict access to the installer and ensure proper input validation to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2008-1386

Produtos afetados

Serendipity

Referências · 10

• 🔥 http://securityfocus.com/bid/28885 · Exploit
• http://int21.de/cve/CVE-2008-1386-s9y.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-1386 · Nota de Segurança
• http://archives.neohapsis.com/archives/fulldisclosure/2008-04/0590.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41967 · Nota
• http://securityfocus.com/archive/1/491176/100/0/threaded · Nota
• http://blog.s9y.org/archives/193-Serendipity-1.3.1-released.html · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1386 · Nota
• http://securitytracker.com/id?1019915 · Nota
• http://vupen.com/english/advisories/2008/1348/references · Nota