PT-2019-12531 · Serendipity · Serendipity

Hanno Böck · Published 2019-05-09 · Updated 2019-05-10 · CVE-2019-11870

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Serendipity versions prior to 2.1.5

Description The issue arises from mishandled EXIF data in the Editor Preview feature of the templates/2k11/admin/media choose.tpl or the Media Library feature of the templates/2k11/admin/media items.tpl, leading to a cross-site scripting (XSS) vulnerability.

Recommendations For versions prior to 2.1.5, update to version 2.1.5 or later to resolve the issue. As a temporary workaround, consider disabling the Editor Preview feature in the templates/2k11/admin/media choose.tpl and restricting access to the Media Library feature in the templates/2k11/admin/media items.tpl until the update is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-11870

Affected Products

Serendipity

References · 6

• https://osv.dev/vulnerability/CVE-2019-11870 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11870 · Security Note
• https://blog.s9y.org/archives/282-Serendipity-2.1.5-released.html · Vendor Advisory
• https://github.com/s9y/Serendipity/issues/598 · Note
• https://openwall.com/lists/oss-security/2019/05/03/3 · Note
• http://openwall.com/lists/oss-security/2019/05/10/1 · Note