CVE-2017-8102: XSS
Stored XSS in Serendipity v2.1-rc1 allows an attacker to steal an admin's cookie and other information by composing a new entry as an editor user. This is related to lack of the serendipityeventxsstrust plugin and a setconfig error in that plugin.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-8102?
CVE-2017-8102 is considered a critical vulnerability due to the potential for attackers to perform Stored XSS attacks.
How do I fix CVE-2017-8102?
To fix CVE-2017-8102, update Serendipity to a version later than v2.1-rc1 that includes the serendipity_event_xsstrust plugin.
What type of vulnerability is CVE-2017-8102?
CVE-2017-8102 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Serendipity blogging platform.
Who is affected by CVE-2017-8102?
Any user running Serendipity v2.1-rc1 with editor privileges is at risk from CVE-2017-8102.
Can CVE-2017-8102 allow data theft?
Yes, CVE-2017-8102 can enable attackers to steal cookies and sensitive information from admin users.