PT-2010-4432 · Serendipity · Serendipity

Hanno Böck · Publicado 2010-09-10 · Atualizado 2010-09-10 · CVE-2010-2957

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Serendipity versions prior to 1.5.4

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors when "Remember me" logins are enabled.

Recommendations For versions prior to 1.5.4, update to version 1.5.4 or later to resolve the issue. As a temporary workaround, consider disabling the "Remember me" login feature until a patch is available.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2010-2957

Produtos afetados

Serendipity

Referências · 6

• 🔥 http://htbridge.ch/advisory/xss_vulnerability_in_serendipity.html · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2957 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-2957 · Nota de Segurança
• http://openwall.com/lists/oss-security/2010/08/31/5 · Nota
• http://blog.s9y.org/archives/223-Serendipity-1.5.4-released.html · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2010/08/29/3 · Nota