CVE-2015-6968: Medium severity serendipity vulnerability
Multiple incomplete blacklist vulnerabilities in the serendipityisActiveFile function in include/functionsimages.inc.php in Serendipity before 2.0.2 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a (1) .pht or (2) .phtml extension.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2015-6968?
CVE-2015-6968 is considered a critical vulnerability as it allows remote authenticated users to execute arbitrary PHP code via file uploads.
How do I fix CVE-2015-6968?
To fix CVE-2015-6968, upgrade Serendipity to version 2.0.2 or later which addresses this vulnerability.
Who is affected by CVE-2015-6968?
CVE-2015-6968 affects users of Serendipity versions prior to 2.0.2.
What are the exploit capabilities of CVE-2015-6968?
CVE-2015-6968 allows attackers to upload files with .pht or .phtml extensions to execute arbitrary PHP code.
Is authentication required to exploit CVE-2015-6968?
Yes, an attacker must be an authenticated user to exploit CVE-2015-6968.