This host is running Serendipity and is prone to cross site scripting vulnerability.

Successful exploitation will allow attacker to steal cookie-based authentication credentials, disclosure or modification of sensitive data. Impact Level: Application

Upgrade to Serendipity version 1.5.4 or later. For updates refer to http://www.s9y.org/12.html

The flaw exists due to failure in the 'include/functions_entries.inc.php' script to properly sanitize user-supplied input in 'serendipity[body]' variable.

Serendipity prior to 1.5.4 and on all platforms.

• http://blog.s9y.org/archives/223-Serendipity-1.5.4-released.html
• http://www.htbridge.ch/advisory/xss_vulnerability_in_serendipity.html
• http://www.openwall.com/lists/oss-security/2010/08/29/3

---

Updated on 2015-03-25