CVE-2016-9752: SSRF
Published Dec 1, 2016
·Updated
In Serendipity before 2.0.5, an attacker can bypass SSRF protection by using a malformed IP address (e.g., http://127.1) or a 30x (aka Redirection) HTTP status code.
Affected Software
1 affected component
S9Y serendipity<=2.0.4
Remediation
Event History
Dec 1, 2016
CVE Published
via MITRE·11:00 AM
Data Sourced
via MITRE·11:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-9752?
The severity of CVE-2016-9752 is considered moderate due to the potential for SSRF attacks.
2
How do I fix CVE-2016-9752?
To fix CVE-2016-9752, upgrade your Serendipity installation to version 2.0.5 or later.
3
What types of attacks are possible with CVE-2016-9752?
CVE-2016-9752 allows attackers to bypass SSRF protections using malformed IP addresses or redirection status codes.
4
Which versions of Serendipity are affected by CVE-2016-9752?
Serendipity versions prior to 2.0.5 are affected by CVE-2016-9752.
5
What is SSRF in the context of CVE-2016-9752?
In the context of CVE-2016-9752, SSRF refers to Server-Side Request Forgery, a type of attack where an attacker can make requests to internal resources.