FKIE_CVE-2010-1916

Vulnerability from fkie_nvd - Published: 2010-05-12 11:46 - Updated: 2026-06-16 23:19
Severity
Summary
The dynamic configuration feature in Xinha WYSIWYG editor 0.96 Beta 2 and earlier, as used in Serendipity 1.5.2 and earlier, allows remote attackers to bypass intended access restrictions and modify the configuration of arbitrary plugins via (1) crafted backend_config_secret_key_location and backend_config_hash parameters that are used in a SHA1 hash of a shared secret that can be known or externally influenced, which are not properly handled by the "Deprecated config passing" feature; or (2) crafted backend_data and backend_data[key_location] variables, which are not properly handled by the xinha_read_passed_data function. NOTE: this can be leveraged to upload and possibly execute arbitrary files via config.inc.php in the ImageManager plugin.
References
cve@mitre.orghttp://lists.fedoraproject.org/pipermail/package-announce/2010-June/042577.html
cve@mitre.orghttp://secunia.com/advisories/39782
cve@mitre.orghttp://secunia.com/advisories/40124
cve@mitre.orghttp://trac.xinha.org/ticket/1518
cve@mitre.orghttp://www.php-security.org/2010/05/10/mops-2010-019-serendipity-wysiwyg-editor-plugin-configuration-injection-vulnerability/index.htmlExploit
cve@mitre.orghttp://www.php-security.org/2010/05/10/mops-2010-020-xinha-wysiwyg-plugin-configuration-injection-vulnerability/index.htmlExploit
cve@mitre.orghttp://www.securityfocus.com/bid/40033
cve@mitre.orghttp://www.vupen.com/english/advisories/2010/1401
cve@mitre.orghttps://bugzilla.redhat.com/show_bug.cgi?id=591701
af854a3a-2127-422b-91ae-364da2661108http://lists.fedoraproject.org/pipermail/package-announce/2010-June/042577.html
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/39782
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/40124
af854a3a-2127-422b-91ae-364da2661108http://trac.xinha.org/ticket/1518
af854a3a-2127-422b-91ae-364da2661108http://www.php-security.org/2010/05/10/mops-2010-019-serendipity-wysiwyg-editor-plugin-configuration-injection-vulnerability/index.htmlExploit
af854a3a-2127-422b-91ae-364da2661108http://www.php-security.org/2010/05/10/mops-2010-020-xinha-wysiwyg-plugin-configuration-injection-vulnerability/index.htmlExploit
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/40033
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2010/1401
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=591701
Impacted products
Vendor Product Version
xinha wysiwyg_editor 0.9
xinha wysiwyg_editor 0.91
xinha wysiwyg_editor 0.92
xinha wysiwyg_editor 0.93
xinha wysiwyg_editor 0.94
xinha wysiwyg_editor 0.95
xinha wysiwyg_editor 0.96
xinha wysiwyg_editor 0.96
s9y serendipity 0.3
s9y serendipity 0.4
s9y serendipity 0.5
s9y serendipity 0.6
s9y serendipity 0.7
s9y serendipity 0.7.1
s9y serendipity 0.8
s9y serendipity 0.8.1
s9y serendipity 0.8.2
s9y serendipity 0.8.3
s9y serendipity 0.8.4
s9y serendipity 0.8.5
s9y serendipity 0.9
s9y serendipity 0.9.1
s9y serendipity 1.0
s9y serendipity 1.0.1
s9y serendipity 1.0.2
s9y serendipity 1.0.3
s9y serendipity 1.0.4
s9y serendipity 1.1
s9y serendipity 1.1.1
s9y serendipity 1.1.2
s9y serendipity 1.1.3
s9y serendipity 1.1.4
s9y serendipity 1.2
s9y serendipity 1.2.1
s9y serendipity 1.3
s9y serendipity 1.3.1
s9y serendipity 1.4
s9y serendipity 1.4.1
s9y serendipity 1.5
s9y serendipity 1.5.1
s9y serendipity 1.5.2
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:xinha:wysiwyg_editor:0.9:beta:*:*:*:*:*:*",
              "matchCriteriaId": "FC6539B7-3759-4BEC-A41E-963C639F3D92",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xinha:wysiwyg_editor:0.91:beta:*:*:*:*:*:*",
              "matchCriteriaId": "E49B705C-DE5F-4DB5-96C6-3AA33B172A8B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xinha:wysiwyg_editor:0.92:beta:*:*:*:*:*:*",
              "matchCriteriaId": "E63C90F4-78A4-4532-B85C-C619FC803F2A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xinha:wysiwyg_editor:0.93:*:*:*:*:*:*:*",
              "matchCriteriaId": "0F303DC9-EDA4-4E99-8B8B-A1867F125A44",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xinha:wysiwyg_editor:0.94:*:*:*:*:*:*:*",
              "matchCriteriaId": "E71A44B7-ADFA-4E2C-8744-DD55DE409ACB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xinha:wysiwyg_editor:0.95:*:*:*:*:*:*:*",
              "matchCriteriaId": "A8B59CDE-D0CE-42D5-9221-22F7B55BA4C6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xinha:wysiwyg_editor:0.96:beta:*:*:*:*:*:*",
              "matchCriteriaId": "0D96327E-17D2-4100-A9A6-BC5741FC5125",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xinha:wysiwyg_editor:0.96:beta2:*:*:*:*:*:*",
              "matchCriteriaId": "25254A30-6E90-4232-9D68-491E0BB06141",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "62233D77-9838-48AB-9A2D-F4EAA9E237EB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "5A6F23BF-1C25-4A5E-9EC4-35A1A821A235",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:0.5:pl1:*:*:*:*:*:*",
              "matchCriteriaId": "5A65D59D-DDFF-4551-987C-D449A4C6F57A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:0.6:pl3:*:*:*:*:*:*",
              "matchCriteriaId": "894A8EF2-0014-49CB-9947-65E1C3CDE0D5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:0.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "925A50B9-0CEF-42FF-8359-52BAFB4FEBB5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:0.7.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "C739BCD2-1722-42E0-9560-752DBBF05BC1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:0.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "B7515A9A-1FD0-484E-97CB-5969729804DB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:0.8.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "40A451C0-D4D8-43FF-BFC9-E525138DCA37",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:0.8.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "9E1F8976-0691-4C47-9BA3-BC01BA808BE3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:0.8.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "7B2FF146-8CEF-48C8-81A3-08B4736DC27D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:0.8.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "5986FA95-D0F8-4E41-A445-F2F0EFEE872A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:0.8.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "22A4B77F-67DC-4D25-8948-0C0B59C38E07",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:0.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "E24AD8E2-AEB7-4D73-9B15-AE0B293A0825",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:0.9.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "47CE7E31-9C42-434E-B1B7-F38966514405",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "7F5193D1-4BB6-4B2C-8361-BA1C7BE7524B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:1.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "7B62B695-74A2-49AA-87EF-38F129A94755",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:1.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "6D4ACB96-F32D-40E2-A9F3-A3CD78658C4F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:1.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "6B027CFC-5E0E-45D3-82BC-8F59F386D188",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:1.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "A3C6CB12-9D14-4D5C-8FC0-02179436B487",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "23D55BCF-58D1-48D8-9BA2-2884F6126F8F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:1.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "707176E4-B735-4A6A-AC7D-01250663D25D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:1.1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "0132EF3F-F9D8-4CEC-A774-4929B4DE6E55",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:1.1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "E2217392-37F3-4CC6-85DE-33CB8841814F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:1.1.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "706E7CF6-C396-4A19-B87C-05BA8C8D9EE9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "D0C422BF-FBDE-4DD2-BB55-868B19890479",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:1.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "A1E92848-05FA-45EE-BD8A-98E337131892",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "96AD0492-E4D4-4A43-80EF-5F38F62DFF25",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:1.3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "7B176479-5EFB-4943-801A-676B74C04DDA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:1.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "D68BD0B3-FB77-4288-93F4-2E018789D858",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:1.4.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "0E6CE765-5EA9-4E38-8EB4-2913CEBE5F44",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:1.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "CE962E7C-08A3-44E4-B06D-E00A03C3DB16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:1.5.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "91A8DDF5-F344-4810-AAFA-31085CC8ED01",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:s9y:serendipity:1.5.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "8058BE3F-6C1E-4B6D-922D-909022D897CB",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The dynamic configuration feature in Xinha WYSIWYG editor 0.96 Beta 2 and earlier, as used in Serendipity 1.5.2 and earlier, allows remote attackers to bypass intended access restrictions and modify the configuration of arbitrary plugins via (1) crafted backend_config_secret_key_location and backend_config_hash parameters that are used in a SHA1 hash of a shared secret that can be known or externally influenced, which are not properly handled by the \"Deprecated config passing\" feature; or (2) crafted backend_data and backend_data[key_location] variables, which are not properly handled by the xinha_read_passed_data function.  NOTE: this can be leveraged to upload and possibly execute arbitrary files via config.inc.php in the ImageManager plugin."
    },
    {
      "lang": "es",
      "value": "La funcionalidad de configuraci\u00f3n din\u00e1mica del editor Xinha WYSIWYG v0.96 Beta 2 y anteriores, como la utilizada en Serendipity v1.5.2 y anteriores, permite a atacantes remotos evitar las restricciones de acceso pretendidas y modificar la configuraci\u00f3n de complementos -plugins- de su elecci\u00f3n mediante (1) los par\u00e1metros modificados backend_config_secret_key_location y backend_config_hash que se utilizan en un hash SHA1 de un secreto compartido que pueden ser conocidos o influenciados externamente, los cuales no son manejados adecuadamente por la funcionalidad \"Deprecated config passing\"; o (2) las variables manipuladas backend_data y backend_data[key_location], las cuales no son manejadas adecuadamente por la funci\u00f3n xinha_read_passed_data. NOTA: Esto puede ser aprovechado para subir y puede que ejecutar los ficheros que se deseen mediante el fichero config.inc.php del complemento ImageManager plugin."
    }
  ],
  "id": "CVE-2010-1916",
  "lastModified": "2026-06-16T23:19:35.033",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2010-05-12T11:46:40.313",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/042577.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/39782"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/40124"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://trac.xinha.org/ticket/1518"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.php-security.org/2010/05/10/mops-2010-019-serendipity-wysiwyg-editor-plugin-configuration-injection-vulnerability/index.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.php-security.org/2010/05/10/mops-2010-020-xinha-wysiwyg-plugin-configuration-injection-vulnerability/index.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/40033"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2010/1401"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=591701"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/042577.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/39782"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/40124"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://trac.xinha.org/ticket/1518"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.php-security.org/2010/05/10/mops-2010-019-serendipity-wysiwyg-editor-plugin-configuration-injection-vulnerability/index.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.php-security.org/2010/05/10/mops-2010-020-xinha-wysiwyg-plugin-configuration-injection-vulnerability/index.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/40033"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2010/1401"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=591701"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.