CVE-2004-2525: XSS
Published Dec 31, 2004
·Updated
Cross-site scripting (XSS) vulnerability in compat.php in Serendipity before 0.7.1 allows remote attackers to inject arbitrary web script or HTML via the searchTerm variable.
Affected Software
16 affected components
S9Y serendipity=0.5
S9Y serendipity=0.4
S9Y serendipity=0.7
S9Y serendipity=0.7_beta1
S9Y serendipity=0.6_rc1
S9Y serendipity=0.5_pl1
S9Y serendipity=0.6_pl2
S9Y serendipity=0.7_beta3
S9Y serendipity=0.7_beta4
S9Y serendipity=0.6_pl1
S9Y serendipity=0.3
S9Y serendipity=0.6_pl3
S9Y serendipity=0.6_rc2
S9Y serendipity=0.7_beta2
S9Y serendipity=0.7_rc1
S9Y serendipity=0.6
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Dec 31, 2004
CVE Published
05:00 AM
Oct 25, 2005
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2004-2525?
CVE-2004-2525 is considered a moderate severity cross-site scripting vulnerability.
2
How do I fix CVE-2004-2525?
To fix CVE-2004-2525, upgrade Serendipity to version 0.7.1 or later.
3
Which versions of Serendipity are affected by CVE-2004-2525?
CVE-2004-2525 affects Serendipity versions prior to 0.7.1, including 0.3 to 0.6_rc2.
4
What type of attack does CVE-2004-2525 enable?
CVE-2004-2525 enables remote attackers to perform cross-site scripting (XSS) attacks.
5
What is the impact of exploiting CVE-2004-2525?
Exploiting CVE-2004-2525 can allow an attacker to inject arbitrary web scripts or HTML into a page viewed by users.