serendipity-xss.txt

`Source: http://www.int21.de/cve/CVE-2007-6205-s9y.html  
  
Cross site scripting (XSS) in rss feed plugin of Serendipity 1.2  
  
References  
http://www.s9y.org/  
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6205  
  
Description  
The Serendipity blog system contains a plugin to display the content of feeds   
in the sidebar (serendipity_plugin_remoterss). If an attacker can modify the   
RSS feed, it's possible to inject javascript code in the link part, because   
it's not correctly escaped.  
  
Sample code  
Sample feed injecting code:  
<rss version="2.0">  
<channel><item><title>foo</title>  
<link>" onMouseOver="alert(1)</link></item></channel>  
</rss>  
  
Workaround/Fix  
Serendipity developers have fixed this in svn and all further version, please   
update to 1.2.1 or above.  
  
CVE Information  
The Common Vulnerabilities and Exposures (CVE) project has assigned the name   
CVE-2007-6205 to this issue. This is a candidate for inclusion in the CVE   
list (http://cve.mitre.org/), which standardizes names for security problems.  
  
Credits and copyright  
This vulnerability was discovered by Hanno Boeck of schokokeks.org webhosting.   
It's licensed under the creative commons attribution license.  
  
Hanno Boeck, 2007-12-05, http://www.hboeck.de  
  
--   
Hanno Böck Blog: http://www.hboeck.de/  
GPG: 3DBD3B20 Jabber/Mail: [email protected]  
`