CVE-2010-1916

First published: Wed May 12 2010(Updated: )

Common Vulnerabilities and Exposures assigned an identifier <a href="https://access.redhat.com/security/cve/CVE-2010-1916">CVE-2010-1916</a> to the following vulnerability: Name: <a href="https://access.redhat.com/security/cve/CVE-2010-1916">CVE-2010-1916</a> URL: <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1916">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1916</a> Assigned: 20100511 Reference: MISC: <a href="http://www.php-security.org/2010/05/10/mops-2010-019-serendipity-wysiwyg-editor-plugin-configuration-injection-vulnerability/index.html">http://www.php-security.org/2010/05/10/mops-2010-019-serendipity-wysiwyg-editor-plugin-configuration-injection-vulnerability/index.html</a> Reference: MISC: <a href="http://www.php-security.org/2010/05/10/mops-2010-020-xinha-wysiwyg-plugin-configuration-injection-vulnerability/index.html">http://www.php-security.org/2010/05/10/mops-2010-020-xinha-wysiwyg-plugin-configuration-injection-vulnerability/index.html</a> The dynamic configuration feature in Xinha WYSIWYG editor 0.96 Beta 2 and earlier, as used in Serendipity 1.5.2 and earlier, allows remote attackers to bypass intended access restrictions and modify the configuration of arbitrary plugins via (1) crafted backend_config_secret_key_location and backend_config_hash parameters that are used in a SHA1 hash of a shared secret that can be known or externally influenced, which are not properly handled by the "Deprecated config passing" feature; or (2) crafted backend_data and backend_data[key_location] variables, which are not properly handled by the xinha_read_passed_data function. NOTE: this can be leveraged to upload and possibly execute arbitrary files via config.inc.php in the ImageManager plugin. The upstream bug report [1] has links to patches to correct this issue. [1] <a href="http://trac.xinha.org/ticket/1518">http://trac.xinha.org/ticket/1518</a>

Credit: cve@mitre.org

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/nvd-historical
• agent/type
• agent/softwarecombine
• collector/mitre-cve
• source/MITRE
• agent/weakness
• agent/author
• agent/last-modified-date
• agent/references
• agent/severity
• agent/description
• agent/first-publish-date
• collector/redhat-bugzilla
• source/Red Hat
• alias/CVE-2010-1916
• agent/event
• agent/trending
• agent/source
• agent/tags
• collector/nvd-index
• agent/software-canonical-lookup-request
• vendor/xinha
• canonical/xinha wysiwyg editor
• version/xinha wysiwyg editor/0.9-beta
• version/xinha wysiwyg editor/0.91-beta
• version/xinha wysiwyg editor/0.92-beta
• version/xinha wysiwyg editor/0.93
• version/xinha wysiwyg editor/0.94
• version/xinha wysiwyg editor/0.95
• version/xinha wysiwyg editor/0.96-beta
• version/xinha wysiwyg editor/0.96-beta2
• vendor/s9y
• canonical/serendipity (s9y) freetag event
• version/serendipity (s9y) freetag event/0.3
• version/serendipity (s9y) freetag event/0.4
• version/serendipity (s9y) freetag event/0.5-pl1
• version/serendipity (s9y) freetag event/0.6-pl3
• version/serendipity (s9y) freetag event/0.7
• version/serendipity (s9y) freetag event/0.7.1
• version/serendipity (s9y) freetag event/0.8
• version/serendipity (s9y) freetag event/0.8.1
• version/serendipity (s9y) freetag event/0.8.2
• version/serendipity (s9y) freetag event/0.8.3
• version/serendipity (s9y) freetag event/0.8.4
• version/serendipity (s9y) freetag event/0.8.5
• version/serendipity (s9y) freetag event/0.9
• version/serendipity (s9y) freetag event/0.9.1
• version/serendipity (s9y) freetag event/1.0
• version/serendipity (s9y) freetag event/1.0.1
• version/serendipity (s9y) freetag event/1.0.2
• version/serendipity (s9y) freetag event/1.0.3
• version/serendipity (s9y) freetag event/1.0.4
• version/serendipity (s9y) freetag event/1.1
• version/serendipity (s9y) freetag event/1.1.1
• version/serendipity (s9y) freetag event/1.1.2
• version/serendipity (s9y) freetag event/1.1.3
• version/serendipity (s9y) freetag event/1.1.4
• version/serendipity (s9y) freetag event/1.2
• version/serendipity (s9y) freetag event/1.2.1
• version/serendipity (s9y) freetag event/1.3
• version/serendipity (s9y) freetag event/1.3.1
• version/serendipity (s9y) freetag event/1.4
• version/serendipity (s9y) freetag event/1.4.1
• version/serendipity (s9y) freetag event/1.5
• version/serendipity (s9y) freetag event/1.5.1
• version/serendipity (s9y) freetag event/1.5.2