CVE-2017-8102

Name of the Vulnerable Software and Affected Versions Serendipity versions 2.1-rc1

Description The issue is related to a Stored XSS that allows an attacker to steal an admin's cookie and other information by composing a new entry as an editor user. This is due to the lack of the serendipity event xsstrust plugin and a set config error in that plugin.

Recommendations For Serendipity version 2.1-rc1, consider installing the serendipity event xsstrust plugin and fixing the set config error in the plugin to mitigate the risk of exploitation.