PT-2016-3929 · Serendipity · Serendipity

Selçuk Miynat · Publicado 2016-01-12 · Atualizado 2018-10-09 · CVE-2015-8603

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Serendipity versions prior to 2.0.3

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the serendipity[entry id] parameter in an "edit" admin action to "serendipity admin.php".

Recommendations For versions prior to 2.0.3, update to version 2.0.3 or later to resolve the issue.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2015-8603

Produtos afetados

Serendipity

Referências · 6

• 🔥 http://packetstormsecurity.com/files/135164/Serendipity-2.0.2-Cross-Site-Scripting.html · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8603 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-8603 · Nota de Segurança
• http://blog.s9y.org/archives/266-Serendipity-2.0.3-released.html · Aviso do Fabricante
• http://securityfocus.com/archive/1/537248/100/0/threaded · Nota
• http://seclists.org/fulldisclosure/2016/Jan/18 · Nota