CVE-2019-11870

Name of the Vulnerable Software and Affected Versions Serendipity versions prior to 2.1.5

Description The issue arises from mishandled EXIF data in the Editor Preview feature of the templates/2k11/admin/media choose.tpl or the Media Library feature of the templates/2k11/admin/media items.tpl, leading to a cross-site scripting (XSS) vulnerability.

Recommendations For versions prior to 2.1.5, update to version 2.1.5 or later to resolve the issue. As a temporary workaround, consider disabling the Editor Preview feature in the templates/2k11/admin/media choose.tpl and restricting access to the Media Library feature in the templates/2k11/admin/media items.tpl until the update is applied.