Vulmon Recent Vulnerabilities Product List Research Posts Trends Blog About Contact
4.3
CVSSv2

CVE-2019-11870

Published: 09/05/2019 Updated: 10/05/2019
CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6
CVSS v3 Base Score: 6.1 | Impact Score: 2.7 | Exploitability Score: 2.8
VMScore: 383
Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Vulnerability Summary

Serendipity prior to 2.1.5 has XSS via EXIF data that is mishandled in the templates/2k11/admin/media_choose.tpl Editor Preview feature or the templates/2k11/admin/media_items.tpl Media Library feature.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

s9y serendipity

Mailing Lists

Full Disclosure: Re: XSS via EXIF tag in Serendipity blog
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On Fri, May 03, 2019 at 05:42:18PM +0200, Hanno Böck wrote: MITRE assigned CVE-2019-11870 for this issue - -- Henri Salo -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEE/aVSDznAZReWTkxKJ633pE6qdXQFAlzVOGIACgkQJ633pE6q dXT6lhAArWXR0Lp36yH57N6sgGLLF+gQavAOK+DfGjpOIkGsr9stlFzdfSD5HvSM EASX//8sMenVE ...

References

CWE-79https://www.openwall.com/lists/oss-security/2019/05/03/3https://github.com/s9y/Serendipity/issues/598https://blog.s9y.org/archives/282-Serendipity-2.1.5-released.htmlhttp://www.openwall.com/lists/oss-security/2019/05/10/1https://nvd.nist.govhttp://seclists.org/oss-sec/2019/q2/104
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-6267XML injectionCVE-2024-37673CVE-2024-6266CVE-2024-30078arbitrary CVE-2024-36886CVE-2024-5346template injection
Vulmon Logo Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook