Vulnerability in S9y Serendipity
CVE-2010-1916
The dynamic configuration feature in Xinha WYSIWYG editor 0.96 Beta 2 and earlier, as used in Serendipity 1.5.2 and earlier, allows remote attackers to bypass intended access restrictions and modify the configuration of arbitrary plugins via (1) crafted backend_config_secret_key_location and backend_config_hash parameters that are used in a SHA1 hash of a shared secret that can be known or externally influenced, which are not properly handled by the "Deprecated config passing" feature; or (2) crafted backend_data and backend_data[key_location] variables, which are not properly handled by the xinha_read_passed_data function. NOTE: this can be leveraged to upload and possibly execute arbitrary files via config.inc.php in the ImageManager plugin.
Published · last modified .
CVSS v2 metric
CVSS v2 base score 7.5 (High). Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.033 (87.9th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 88th percentile — 87.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.033 · newest: 0.033 · change: 0.000
Affected products
- S9y Serendipity — versions 1.1.1, 0.6, 0.7.1
- Xinha Wysiwyg Editor — versions 0.91, 0.92, 0.94
Weakness classification (CWE)
References
- bugzilla.redhat.com/show_bug.cgi
- www.vupen.com/english/advisories/2010/1401 (vdb-entry)
- www.php-security.org/2010/05/10/mops-2010-020-xinha-wysiwyg-plugin-configuratio… (Exploit)
- secunia.com/advisories/40124 (third-party-advisory)
- secunia.com/advisories/39782 (third-party-advisory)
- www.securityfocus.com/bid/40033 (vdb-entry)
- trac.xinha.org/ticket/1518
- lists.fedoraproject.org/pipermail/package-announce/2010-June/042577.html (vendor-advisory)
- www.php-security.org/2010/05/10/mops-2010-019-serendipity-wysiwyg-editor-plugin… (Exploit)