PT-2004-2527 · Serendipity · Serendipity

Chaotic Evil · Published 2004-10-21 · Updated 2017-07-11 · CVE-2004-1620

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Serendipity versions prior to 0.7rc1

Description The issue allows remote attackers to perform HTTP Response Splitting attacks, modifying expected HTML content from the server. This can be achieved via the url parameter in index.php and exit.php, or the HTTP Referer field in comment.php.

Recommendations For versions prior to 0.7rc1, update to version 0.7rc1 or later to resolve the issue. As a temporary workaround, consider restricting access to the url parameter in index.php and exit.php, and limiting the use of the HTTP Referer field in comment.php to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2004-1620

Affected Products

Serendipity

References · 16

• 🔥 http://s9y.org/5.html · Exploit
• 🔥 http://secunia.com/advisories/12909 · Exploit
• 🔥 http://securityfocus.com/bid/11497 · Exploit
• 🔥 https://exploit-db.com/exploits/24697 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-1620 · Security Note
• http://osvdb.org/11038 · Note
• http://cvs.sourceforge.net/viewcvs.py/php-blog/serendipity/exit.php?rev=1.10&view=markup · Note
• http://cvs.sourceforge.net/viewcvs.py/php-blog/serendipity/index.php?rev=1.52&view=markup · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1620 · Note
• http://osvdb.org/11013 · Note
• http://osvdb.org/11039 · Note
• http://marc.info/?l=bugtraq&m=109841283115808&w=2 · Note
• http://sourceforge.net/project/shownotes.php?release_id=276694 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17798 · Note
• http://cvs.sourceforge.net/viewcvs.py/php-blog/serendipity/comment.php?rev=1.49&view=markup · Note