CVE-2007-4282 The "Extended properties for entries" (entryproperties) plugin in serendipity_event_entryproperties.php in Serendipity 1.1.3 allows remote authenticated users to bypass password protection and "delive...
MediumCVSS 5.0
EPSS 1.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The "Extended properties for entries" (entryproperties) plugin in serendipity_event_entryproperties.php in Serendipity 1.1.3 allows remote authenticated users to bypass password protection and "deliver custom entryproperties settings to the Serendipity Frontend" via a certain request that modifies the password being checked.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| serendipity | = 1.1.3 | No fix listed |
References
- blog.drinsama.de
- blog.s9y.org
- 36534 vdb-entry
- 26347 third-party-advisory vendor-advisory
- sourceforge.net patch
- sourceforge.net
- 25235 vdb-entry
- serendipity-extendedprop-security-bypass(35868) vdb-entry