Unscored CVE-2019-11870 EUVD-2019-3530GHSA-592q-gqc9-78rw

Serendipity before 2.1.5 has XSS via EXIF data that is mishandled in the templates/2k11/admin/media_choose.tpl Editor Preview feature or th…

Published May 9, 2019 · Updated Aug 4, 2024 · Assigned by mitre

Description

Serendipity before 2.1.5 has XSS via EXIF data that is mishandled in the templates/2k11/admin/media_choose.tpl Editor Preview feature or the templates/2k11/admin/media_items.tpl Media Library feature.

References

https://blog.s9y.org/archives/282-Serendipity-2.1.5-released.html
https://www.openwall.com/lists/oss-security/2019/05/03/3
https://github.com/s9y/Serendipity/issues/598
[oss-security] 20190510 Re: XSS via EXIF tag in Serendipity blog mailing-list