PT-2019-12531
CVE-2019-11870
·
تاريخ النشر
2019-05-09
·
تاريخ التحديث
2019-05-10
الوصف من
CVSS 3.1
6.1
متوسطةالمقاييسAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
Serendipity versions prior to 2.1.5
Description
The issue arises from mishandled EXIF data in the Editor Preview feature of the templates/2k11/admin/media choose.tpl or the Media Library feature of the templates/2k11/admin/media items.tpl, leading to a cross-site scripting (XSS) vulnerability.
Recommendations
For versions prior to 2.1.5, update to version 2.1.5 or later to resolve the issue. As a temporary workaround, consider disabling the Editor Preview feature in the templates/2k11/admin/media choose.tpl and restricting access to the Media Library feature in the templates/2k11/admin/media items.tpl until the update is applied.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾