Re: CVE-request: Serendipity 'serendipity[filter][bp.ALT]' Cross-Site Scripting vulnerability

[Kurt Seifried <kseifried () redhat com>]

On 12/01/2011 10:12 AM, Kurt Seifried wrote:
> On 12/01/2011 02:59 AM, Henri Salo wrote:
> > Original post: http://seclists.org/bugtraq/2011/Nov/15
> > Advisory URL: http://www.rul3z.de/advisories/SSCHADV2011-015.txt
> > New version announcement: http://blog.s9y.org/archives/233-Serendipity-1.6-released.html
> >
> > I contacted Garvin Hicking and he said this is indeed fixed in 1.6 code, but they changed from SVN to Git so can't 
> > really refer to proper commit. Secunia is linking in http://secunia.com/advisories/46666/ to 
> > https://github.com/s9y/Serendipity/commit/1f037b462761cd592b90541ce4dfda2518ad4711, which has nothing to do with the 
> > actual issue. Shame on Secunia.
> >
> > This is one of logs, which can act like proof: 
> > https://github.com/s9y/Serendipity/commit/db590df6087969e5ef3b07b1b7040e7ec122a4fd
> >
> > Please notify me if this is not enough information.
> >
> > - Henri Salo
> Please use CVE-2011-4365 for this issue.
My mistake, this should have been merged into CVE-2011-4090, it's the
same vuln type (XSS) and the same version of Serendipity, CVE-2011-4365
is a bad assignment and should be marked as a duplicate of CVE-2011-4090.

-- 

-Kurt Seifried / Red Hat Security Response Team