Re: CVE-request: Serendipity 'serendipity[filter][bp.ALT]' Cross-Site Scripting vulnerability

[Henri Salo <henri () nerv fi>]

On Thu, Dec 01, 2011 at 02:13:16PM +0100, Secunia Research wrote:
> Henri,
>
> The GIT commit referenced by the Secunia advisory [1] is the correct fix for
> this issue.
>
> The fix removed a line in the code that displayed an unsanitised variable in
> one of the template files. This variable was inside a JavaScript comment
> block, but this does not prevent exploitation when the payload is prefixed
> with a </script> tag.
>
> [1]
> https://github.com/s9y/Serendipity/commit/1f037b462761cd592b90541ce4dfda2518
> ad4711
>
> --
>
> Med venlig hilsen / Kind Regards,
>  
> Jon Butler
> Junior Security Specialist
>   
> Secunia
> Mikado House
> Rued Langgaardsvej 8
> 2300 Copenhagen S
> Denmark 
>
> Phone +45 3338 5726
>
> Please visit our corporate website:
> www.secunia.com
>    
> Follow us on Twitter:
> http://twitter.com/secunia

Sorry I misunderstood. Thank you for clearing this out. Developer of this software did not comment anything when I 
asked if this is correct or not, but they indeed told me about a change to different version controlling software.

- Henri Salo