Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2011-1133: Serendipity before 1.5.5 lets attackers run code

CVE-2011-1133 · published 7 years ago

Summary

The Serendipity blog platform (versions prior to 1.5.5) contains a flaw in its file manager component that can let a remote user inject malicious scripts. This could allow the attacker to run unwanted code in the browser of anyone viewing the affected page. Update Serendipity to version 1.5.5 or later to close the issue.

What to do

Update s9y serendipity to version 1.5.5 or later.

Affected software

Vendor	Product	Affected versions
s9y	serendipity	< 1.5.5 `cpe:2.3:a:s9y:serendipity::::::::`

Original advisory text

Cross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5, allows remote attackers to execute arbitrary code via plugins/ExtendedFileManager/backend.php.

References

https://blog.s9y.org/archives/224-Important-Security-Update-Serendipity-1.5.5-re... Release Notes Vendor Advisory
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=611661 Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2011-1133 Third Party Advisory
https://www.openwall.com/lists/oss-security/2011/03/02/5 Mailing List Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.1 Medium

Exploitation

2% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published5 Nov 2019

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2011-1133 · NVD

Track software like this

Free during beta