PT-2009-4617 · Serendipity · Serendipity

Published 2009-06-22 · Updated 2009-06-26 · CVE-2009-2165

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SerendipityNZ (aka SimpleBoxes) Serene Bach versions 2.20R and earlier SerendipityNZ (aka SimpleBoxes) Serene Bach versions 3.00 beta023 and earlier

Description The issue allows remote attackers to hijack sessions due to the use of a predictable session id.

Recommendations For versions 2.20R and earlier, update to a version later than 2.20R to resolve the issue. For versions 3.00 beta023 and earlier, update to a version later than 3.00 beta023 to resolve the issue. As a temporary workaround, consider regenerating session ids regularly until a patch is available.

Fix

Related Identifiers

CVE-2009-2165

Affected Products

Serendipity

References · 6

• http://serenebach.net/log/sb221R.html · Vendor Advisory
• http://secunia.com/advisories/35335 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-2165 · Security Note
• http://jvn.jp/en/jp/JVN20689557/index.html · Note
• http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000035.html · Note
• http://securityfocus.com/bid/35254 · Note