VRDA Feed by JPCERT/CC
  Vulnerability Response Decision Assistance Feed : Information for vulnerability impact analysis
[ about VRDA Feed | JPCERT/CC ] 



 
Vulnerability Analysis Result (Revision No : 1) [ Download XML ] 
CVE-2010-1916
serendipity, wysiwyg_editor: The dynamic configuration feature in Xinha WYSIWYG ...
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-1916

Original

The dynamic configuration feature in Xinha WYSIWYG editor 0.96 Beta 2 and earlier, as used in Serendipity 1.5.2 and earlier, allows remote attackers to bypass intended access restrictions and modify the configuration of arbitrary plugins via (1) crafted backend_config_secret_key_location and backend_config_hash parameters that are used in a SHA1 hash of a shared secret that can be known or externally influenced, which are not properly handled by the "Deprecated config passing" feature; or (2)...

Translation   (Show)





About This Analysis Information
Analysis Information Provider:
NIST NVD
First Published:
2010-05-12
Source Information Category:
Advisory, Alert
Last Updated:
2010-05-12




Affected Product Tags
cpe:/a:s9y:serendipity:0.3
cpe:/a:s9y:serendipity:0.4
cpe:/a:s9y:serendipity:0.5:pl1
cpe:/a:s9y:serendipity:0.6:pl3
cpe:/a:s9y:serendipity:0.7
cpe:/a:s9y:serendipity:0.7.1
cpe:/a:s9y:serendipity:0.8
cpe:/a:s9y:serendipity:0.8.1
cpe:/a:s9y:serendipity:0.8.2
cpe:/a:s9y:serendipity:0.8.3
cpe:/a:s9y:serendipity:0.8.4
cpe:/a:s9y:serendipity:0.8.5
cpe:/a:s9y:serendipity:0.9
cpe:/a:s9y:serendipity:0.9.1
cpe:/a:s9y:serendipity:1.0
cpe:/a:s9y:serendipity:1.0.1
cpe:/a:s9y:serendipity:1.0.2
cpe:/a:s9y:serendipity:1.0.3
cpe:/a:s9y:serendipity:1.0.4
cpe:/a:s9y:serendipity:1.1
cpe:/a:s9y:serendipity:1.1.1
cpe:/a:s9y:serendipity:1.1.2
cpe:/a:s9y:serendipity:1.1.3
cpe:/a:s9y:serendipity:1.1.4
cpe:/a:s9y:serendipity:1.2
cpe:/a:s9y:serendipity:1.2.1
cpe:/a:s9y:serendipity:1.3
cpe:/a:s9y:serendipity:1.3.1
cpe:/a:s9y:serendipity:1.4
cpe:/a:s9y:serendipity:1.4.1
cpe:/a:s9y:serendipity:1.5
cpe:/a:s9y:serendipity:1.5.1
cpe:/a:s9y:serendipity:1.5.2
cpe:/a:xinha:wysiwyg_editor:0.91:beta
cpe:/a:xinha:wysiwyg_editor:0.92:beta
cpe:/a:xinha:wysiwyg_editor:0.93
cpe:/a:xinha:wysiwyg_editor:0.94
cpe:/a:xinha:wysiwyg_editor:0.95
cpe:/a:xinha:wysiwyg_editor:0.96:beta
cpe:/a:xinha:wysiwyg_editor:0.96:beta2
cpe:/a:xinha:wysiwyg_editor:0.9:beta
 


Vulnerability Analysis Results
[Access Vector]  [?]
Undefined [?]

Local [?]
Adjacent Network [?]
X Network [?]
[Access Complexit]  [?]
Undefined [?]

High [?]
Medium [?]
X Low [?]
[Authentication]  [?]
Undefined [?]

Multiple [?]
Single [?]
X None [?]
[Confidentiality Impact]  [?]
Undefined [?]

None [?]
X Partial [?]
Complete [?]
[Integrity Impact]  [?]
Undefined [?]

None [?]
X Partial [?]
Complete [?]
[Availability Impact]  [?]
Undefined [?]

None [?]
X Partial [?]
Complete [?]
Alternatives




References
MISC http://www.php-security.org/2010/05/10/mops-2010-020-xinha-wysiwyg-plugin-configuration-injection-vulnerability/index.html




MISC http://www.php-security.org/2010/05/10/mops-2010-019-serendipity-wysiwyg-editor-plugin-configuration-injection-vulnerability/index.html




Vulnerability Type Permissions, Privileges, and Access Control (CWE-264)




Copyright © 2010 JPCERT/CC All Rights Reserved.