CVE-2017-8102

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Stored XSS in Serendipity v2.1-rc1 allows an attacker to steal an admin's cookie and other information by composing a new entry as an editor user. This is related to lack of the serendipity_event_xsstrust plugin and a set_config error in that plugin.

Metrics

CVSS 3.0 5.4/10CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://seclists.org/fulldisclosure/2017/Apr/44Exploit, Third Party Advisory, VDB Entry
https://github.com/s9y/Serendipity/issues/456Exploit, Third Party Advisory
http://seclists.org/fulldisclosure/2017/Apr/44Exploit, Third Party Advisory, VDB Entry
https://github.com/s9y/Serendipity/issues/456Exploit, Third Party Advisory

Timeline

Published: Apr 24, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-81036.1In MyBB before 1.8.11, the Email MyCode component allows XSS, as demonstrated by an onmouseover event.CVE-2017-81045.3In MyBB before 1.8.11, the smilie module allows Directory Traversal via the pathfolder parameter.CVE-2017-81059.8FreeType 2 before 2017-03-24 has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_decoder_parse_charstrings f CVE-2017-81065.5The handle_invept function in arch/x86/kvm/vmx.c in the Linux kernel 3.12 through 3.15 allows privileged KVM guest OS users to cause a denia CVE-2017-81087.8Unspecified tests in Lynis before 2.5.0 allow local users to write to arbitrary files or possibly gain privileges via a symlink attack on a CVE-2017-81097.8The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permiss CVE-2017-811010.0www.modified-shop.org modified eCommerce Shopsoftware 2.0.2.2 rev 10690 has XXE in api/it-recht-kanzlei/api-it-recht-kanzlei.php.CVE-2017-81126.5hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (infinite loop and CPU CVE-2017-81148.8Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.CVE-2017-81155.3Directory traversal in setup/processors/url_search.php (aka the search page of an unused processor) in MODX Revolution 2.5.7 might allow rem CVE-2017-81169.8The management interface for the Teltonika RUT9XX routers (aka LuCI) with firmware 00.03.265 and earlier allows remote attackers to execute CVE-2017-81179.8The UMA product with software V200R001 and V300R001 has a privilege elevation vulnerability due to insufficient validation or improper proce