fkie_cve-2010-1916
Vulnerability from fkie_nvd
Published
2010-05-12 11:46
Modified
2024-11-21 01:15
Severity ?
Summary
The dynamic configuration feature in Xinha WYSIWYG editor 0.96 Beta 2 and earlier, as used in Serendipity 1.5.2 and earlier, allows remote attackers to bypass intended access restrictions and modify the configuration of arbitrary plugins via (1) crafted backend_config_secret_key_location and backend_config_hash parameters that are used in a SHA1 hash of a shared secret that can be known or externally influenced, which are not properly handled by the "Deprecated config passing" feature; or (2) crafted backend_data and backend_data[key_location] variables, which are not properly handled by the xinha_read_passed_data function. NOTE: this can be leveraged to upload and possibly execute arbitrary files via config.inc.php in the ImageManager plugin.
References
cve@mitre.orghttp://lists.fedoraproject.org/pipermail/package-announce/2010-June/042577.html
cve@mitre.orghttp://secunia.com/advisories/39782
cve@mitre.orghttp://secunia.com/advisories/40124
cve@mitre.orghttp://trac.xinha.org/ticket/1518
cve@mitre.orghttp://www.php-security.org/2010/05/10/mops-2010-019-serendipity-wysiwyg-editor-plugin-configuration-injection-vulnerability/index.htmlExploit
cve@mitre.orghttp://www.php-security.org/2010/05/10/mops-2010-020-xinha-wysiwyg-plugin-configuration-injection-vulnerability/index.htmlExploit
cve@mitre.orghttp://www.securityfocus.com/bid/40033
cve@mitre.orghttp://www.vupen.com/english/advisories/2010/1401
cve@mitre.orghttps://bugzilla.redhat.com/show_bug.cgi?id=591701
af854a3a-2127-422b-91ae-364da2661108http://lists.fedoraproject.org/pipermail/package-announce/2010-June/042577.html
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/39782
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/40124
af854a3a-2127-422b-91ae-364da2661108http://trac.xinha.org/ticket/1518
af854a3a-2127-422b-91ae-364da2661108http://www.php-security.org/2010/05/10/mops-2010-019-serendipity-wysiwyg-editor-plugin-configuration-injection-vulnerability/index.htmlExploit
af854a3a-2127-422b-91ae-364da2661108http://www.php-security.org/2010/05/10/mops-2010-020-xinha-wysiwyg-plugin-configuration-injection-vulnerability/index.htmlExploit
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/40033
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2010/1401
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=591701
Impacted products
Vendor Product Version
xinha wysiwyg_editor 0.9
xinha wysiwyg_editor 0.91
xinha wysiwyg_editor 0.92
xinha wysiwyg_editor 0.93
xinha wysiwyg_editor 0.94
xinha wysiwyg_editor 0.95
xinha wysiwyg_editor 0.96
xinha wysiwyg_editor 0.96
s9y serendipity 0.3
s9y serendipity 0.4
s9y serendipity 0.5
s9y serendipity 0.6
s9y serendipity 0.7
s9y serendipity 0.7.1
s9y serendipity 0.8
s9y serendipity 0.8.1
s9y serendipity 0.8.2
s9y serendipity 0.8.3
s9y serendipity 0.8.4
s9y serendipity 0.8.5
s9y serendipity 0.9
s9y serendipity 0.9.1
s9y serendipity 1.0
s9y serendipity 1.0.1
s9y serendipity 1.0.2
s9y serendipity 1.0.3
s9y serendipity 1.0.4
s9y serendipity 1.1
s9y serendipity 1.1.1
s9y serendipity 1.1.2
s9y serendipity 1.1.3
s9y serendipity 1.1.4
s9y serendipity 1.2
s9y serendipity 1.2.1
s9y serendipity 1.3
s9y serendipity 1.3.1
s9y serendipity 1.4
s9y serendipity 1.4.1
s9y serendipity 1.5
s9y serendipity 1.5.1
s9y serendipity 1.5.2


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:xinha:wysiwyg_editor:0.9:beta:*:*:*:*:*:*",
              "matchCriteriaId": "FC6539B7-3759-4BEC-A41E-963C639F3D92",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xinha:wysiwyg_editor:0.91:beta:*:*:*:*:*:*",
              "matchCriteriaId": "E49B705C-DE5F-4DB5-96C6-3AA33B172A8B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xinha:wysiwyg_editor:0.92:beta:*:*:*:*:*:*",
              "matchCriteriaId": "E63C90F4-78A4-4532-B85C-C619FC803F2A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xinha:wysiwyg_editor:0.93:*:*:*:*:*:*:*",
              "matchCriteriaId": "0F303DC9-EDA4-4E99-8B8B-A1867F125A44",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xinha:wysiwyg_editor:0.94:*:*:*:*:*:*:*",
              "matchCriteriaId": "E71A44B7-ADFA-4E2C-8744-DD55DE409ACB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xinha:wysiwyg_editor:0.95:*:*:*:*:*:*:*",
              "matchCriteriaId": "A8B59CDE-D0CE-42D5-9221-22F7B55BA4C6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xinha:wysiwyg_editor:0.96:beta:*:*:*:*:*:*",
              "matchCriteriaId": "0D96327E-17D2-4100-A9A6-BC5741FC5125",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xinha:wysiwyg_editor:0.96:beta2:*:*:*:*:*:*",
              "matchCriteriaId": "25254A30-6E90-4232-9D68-491E0BB06141",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "62233D77-9838-48AB-9A2D-F4EAA9E237EB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "5A6F23BF-1C25-4A5E-9EC4-35A1A821A235",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:0.5:pl1:*:*:*:*:*:*",
              "matchCriteriaId": "5A65D59D-DDFF-4551-987C-D449A4C6F57A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:0.6:pl3:*:*:*:*:*:*",
              "matchCriteriaId": "894A8EF2-0014-49CB-9947-65E1C3CDE0D5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:0.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "925A50B9-0CEF-42FF-8359-52BAFB4FEBB5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:0.7.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "C739BCD2-1722-42E0-9560-752DBBF05BC1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:0.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "B7515A9A-1FD0-484E-97CB-5969729804DB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:0.8.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "40A451C0-D4D8-43FF-BFC9-E525138DCA37",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:0.8.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "9E1F8976-0691-4C47-9BA3-BC01BA808BE3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:0.8.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "7B2FF146-8CEF-48C8-81A3-08B4736DC27D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:0.8.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "5986FA95-D0F8-4E41-A445-F2F0EFEE872A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:0.8.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "22A4B77F-67DC-4D25-8948-0C0B59C38E07",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:0.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "E24AD8E2-AEB7-4D73-9B15-AE0B293A0825",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:0.9.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "47CE7E31-9C42-434E-B1B7-F38966514405",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "7F5193D1-4BB6-4B2C-8361-BA1C7BE7524B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:1.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "7B62B695-74A2-49AA-87EF-38F129A94755",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:1.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "6D4ACB96-F32D-40E2-A9F3-A3CD78658C4F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:1.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "6B027CFC-5E0E-45D3-82BC-8F59F386D188",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:1.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "A3C6CB12-9D14-4D5C-8FC0-02179436B487",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "23D55BCF-58D1-48D8-9BA2-2884F6126F8F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:1.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "707176E4-B735-4A6A-AC7D-01250663D25D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:1.1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "0132EF3F-F9D8-4CEC-A774-4929B4DE6E55",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:1.1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "E2217392-37F3-4CC6-85DE-33CB8841814F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:1.1.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "706E7CF6-C396-4A19-B87C-05BA8C8D9EE9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "D0C422BF-FBDE-4DD2-BB55-868B19890479",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:1.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "A1E92848-05FA-45EE-BD8A-98E337131892",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "96AD0492-E4D4-4A43-80EF-5F38F62DFF25",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:1.3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "7B176479-5EFB-4943-801A-676B74C04DDA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:1.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "D68BD0B3-FB77-4288-93F4-2E018789D858",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:1.4.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "0E6CE765-5EA9-4E38-8EB4-2913CEBE5F44",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:1.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "CE962E7C-08A3-44E4-B06D-E00A03C3DB16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:1.5.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "91A8DDF5-F344-4810-AAFA-31085CC8ED01",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:1.5.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "8058BE3F-6C1E-4B6D-922D-909022D897CB",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The dynamic configuration feature in Xinha WYSIWYG editor 0.96 Beta 2 and earlier, as used in Serendipity 1.5.2 and earlier, allows remote attackers to bypass intended access restrictions and modify the configuration of arbitrary plugins via (1) crafted backend_config_secret_key_location and backend_config_hash parameters that are used in a SHA1 hash of a shared secret that can be known or externally influenced, which are not properly handled by the \"Deprecated config passing\" feature; or (2) crafted backend_data and backend_data[key_location] variables, which are not properly handled by the xinha_read_passed_data function.  NOTE: this can be leveraged to upload and possibly execute arbitrary files via config.inc.php in the ImageManager plugin."
    },
    {
      "lang": "es",
      "value": "La funcionalidad de configuraci\u00f3n din\u00e1mica del editor Xinha WYSIWYG v0.96 Beta 2 y anteriores, como la utilizada en Serendipity v1.5.2 y anteriores, permite a atacantes remotos evitar las restricciones de acceso pretendidas y modificar la configuraci\u00f3n de complementos -plugins- de su elecci\u00f3n mediante (1) los par\u00e1metros modificados backend_config_secret_key_location y backend_config_hash que se utilizan en un hash SHA1 de un secreto compartido que pueden ser conocidos o influenciados externamente, los cuales no son manejados adecuadamente por la funcionalidad \"Deprecated config passing\"; o (2) las variables manipuladas backend_data y backend_data[key_location], las cuales no son manejadas adecuadamente por la funci\u00f3n xinha_read_passed_data. NOTA: Esto puede ser aprovechado para subir y puede que ejecutar los ficheros que se deseen mediante el fichero config.inc.php del complemento ImageManager plugin."
    }
  ],
  "id": "CVE-2010-1916",
  "lastModified": "2024-11-21T01:15:27.593",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2010-05-12T11:46:40.313",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/042577.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/39782"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/40124"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://trac.xinha.org/ticket/1518"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.php-security.org/2010/05/10/mops-2010-019-serendipity-wysiwyg-editor-plugin-configuration-injection-vulnerability/index.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.php-security.org/2010/05/10/mops-2010-020-xinha-wysiwyg-plugin-configuration-injection-vulnerability/index.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/40033"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2010/1401"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=591701"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/042577.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/39782"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/40124"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://trac.xinha.org/ticket/1518"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.php-security.org/2010/05/10/mops-2010-019-serendipity-wysiwyg-editor-plugin-configuration-injection-vulnerability/index.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.php-security.org/2010/05/10/mops-2010-020-xinha-wysiwyg-plugin-configuration-injection-vulnerability/index.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/40033"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2010/1401"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=591701"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.