CVE-2004-1620 Other in n/a
Remote attackers can perform HTTP Response Splitting to modify server HTML content via vulnerable parameters in Serendipity.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2004-1620?
CVE-2004-1620 is a medium-severity vulnerability in S9y Serendipity, published on 20 Feb 2005. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
CRLF injection vulnerability in Serendipity before 0.7rc1 allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML content from the server via the url parameter in (1) index.php and (2) exit.php, or (3) the HTTP Referer field in comment.php.
Which versions are affected by CVE-2004-1620?
It affects 1 product.
Products include S9y Serendipity.
How do I fix CVE-2004-1620?
No fix has been published for CVE-2004-1620 yet. Limit exposure of the affected software until one is available.
Is CVE-2004-1620 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2004-1620 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in S9y Serendipity
Sources
Also known as GHSA-3hfj-vjmw-rjj4.