Vulnerability Description
Cross-site request forgery (CSRF) vulnerability in the mycalendar plugin before 0.13 for Serendipity allows remote attackers to perform actions as blog administrators, which can be leveraged to conduct cross-site scripting (XSS) attacks on the blog page.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Serendipity | Serendipity | <= 0.12 |
Related Weaknesses (CWE)
References
- http://secunia.com/advisories/28152Vendor Advisory
- http://www.hboeck.de/archives/572-Some-XSS-issues-in-Serendipity-found.html
- http://www.securityfocus.com/bid/26955
- http://secunia.com/advisories/28152Vendor Advisory
- http://www.hboeck.de/archives/572-Some-XSS-issues-in-Serendipity-found.html
- http://www.securityfocus.com/bid/26955
FAQ
What is CVE-2007-6390?
CVE-2007-6390 is a vulnerability with a CVSS score of 4.3 (MEDIUM). Cross-site request forgery (CSRF) vulnerability in the mycalendar plugin before 0.13 for Serendipity allows remote attackers to perform actions as blog administrators, which can be leveraged to conduc...
How severe is CVE-2007-6390?
CVE-2007-6390 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2007-6390?
Check the references section above for vendor advisories and patch information. Affected products include: Serendipity Serendipity.