CVE-2017-8102

NONE EPSS 53.9%
Published Apr 24, 20179y ago · Modified Jun 17, 20262w ago
Find Similar
Published Apr 24, 2017 9y ago
Last Modified Jun 17, 2026 2w ago

Description

Stored XSS in Serendipity v2.1-rc1 allows an attacker to steal an admin's cookie and other information by composing a new entry as an editor user. This is related to lack of the serendipity_event_xsstrust plugin and a set_config error in that plugin.

Threat Intelligence

EPSS Exploit Probability
53.9% percentile
Exploit & Patch Status
Public Exploit Known
No Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 1

VendorProductVersionRange
s9yserendipity2.1any

References 2

  • seclists.org http://seclists.org/fulldisclosure/2017/Apr/44
    ExploitThird Party AdvisoryVDB Entry
  • github.com https://github.com/s9y/Serendipity/issues/456
    ExploitThird Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.