PT-2016-4571 · Serendipity · Serendipity

Shinkurto · Published 2016-12-30 · Updated 2017-01-03 · CVE-2016-10082

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Serendipity versions prior to 2.1

Description The issue arises from a failure to sanitize the dbType POST parameter in the include/functions installer.inc.php file, which is then used in an include() call in the bundled-libs/serendipity generateFTPChecksums.php file. This can lead to a File Inclusion and possible Code Execution attack during the first-time installation of Serendipity.

Recommendations For Serendipity versions prior to 2.1, update to version 2.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the include/functions installer.inc.php file and the bundled-libs/serendipity generateFTPChecksums.php file to minimize the risk of exploitation. Avoid using the dbType parameter in the affected installation process until the issue is resolved.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2016-10082

Affected Products

Serendipity

References · 6

• https://github.com/s9y/Serendipity/issues/433 · Patch
• https://github.com/s9y/Serendipity/commit/bba6a840f4d53cbaf62971a3078a98c8ddf92b85 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2016-10082 · Security Note
• https://osv.dev/vulnerability/CVE-2016-10082 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10082 · Note
• http://securityfocus.com/bid/95165 · Note