4.3

CVE-2008-0124

Cross-site scripting (XSS) vulnerability in Serendipity (S9Y) before 1.3-beta1 allows remote authenticated users to inject arbitrary web script or HTML via (1) the "Real name" field in Personal Settings, which is presented to readers of articles; or (2) a file upload, as demonstrated by a .htm, .html, or .js file.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
S9y ≫ Serendipity Version0.3
S9y ≫ Serendipity Version0.4
S9y ≫ Serendipity Version0.5
S9y ≫ Serendipity Version0.5_pl1
S9y ≫ Serendipity Version0.6
S9y ≫ Serendipity Version0.6_pl1
S9y ≫ Serendipity Version0.6_pl2
S9y ≫ Serendipity Version0.6_pl3
S9y ≫ Serendipity Version0.6_rc1
S9y ≫ Serendipity Version0.6_rc2
S9y ≫ Serendipity Version0.7
S9y ≫ Serendipity Version0.7.1
S9y ≫ Serendipity Version0.7_beta1
S9y ≫ Serendipity Version0.7_beta2
S9y ≫ Serendipity Version0.7_beta3
S9y ≫ Serendipity Version0.7_beta4
S9y ≫ Serendipity Version0.7_rc1
S9y ≫ Serendipity Version0.8
S9y ≫ Serendipity Version0.8.1
S9y ≫ Serendipity Version0.8.2
S9y ≫ Serendipity Version0.8_beta_6_snapshot
S9y ≫ Serendipity Version0.8_beta5
S9y ≫ Serendipity Version0.8_beta6
S9y ≫ Serendipity Version0.9.1
S9y ≫ Serendipity Version1.0.3
S9y ≫ Serendipity Version1.0.4
S9y ≫ Serendipity Version1.0_beta2
S9y ≫ Serendipity Version1.0_beta3
S9y ≫ Serendipity Version1.1.1
S9y ≫ Serendipity Version1.1.3
S9y ≫ Serendipity Version1.1.4
S9y ≫ Serendipity Version1.2
S9y ≫ Serendipity Version1.2.1
S9y ≫ Serendipity Version1.2__beta5
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.55% 0.719
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://secunia.com/advisories/29502
http://www.debian.org/security/2008/dsa-1528
http://blog.s9y.org/archives/191-Serendipity-1.3-beta1-released.html
Patch
http://int21.de/cve/CVE-2008-0124-s9y.html
http://secunia.com/advisories/29128
http://www.securityfocus.com/bid/28003
http://www.securitytracker.com/id?1019502
http://www.vupen.com/english/advisories/2008/0700/references
https://exchange.xforce.ibmcloud.com/vulnerabilities/40851