Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Serendipity inserts $SERVER['HTTPHOST'] directly into the Message-ID SMTP header without any validation beyond CRLF stripping. An attacker who can control the Host header during an email-triggering action can inject arbitrary SMTP headers into outgoing emails, enabling spam relay, BCC injection, and email spoofing. Details In include/functions.inc.php:548: The existing sanitization function only blocks \r\n and URL-encoded variants: Critically, serendipityisResponseClean() is not even called on HTTPHOST before embedding it into the mail headers — making this exploitable with any character that SMTP interprets as a header delimiter. Email is triggered by actions such as: - New comment notifications to blog owner - Comment subscription notifications to subscribers - Password reset emails (if configured) PoC Resulting malicious Message-ID header in outgoing email: Impact An attacker can control the domain portion of the Message-ID header in all outgoing emails sent by…
Recommended action: Upgrade to 2.6.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The serendipitysetCookie() function uses $SERVER['HTTPHOST'] without validation as the domain parameter of setcookie(). An attacker can force authentication cookies — including session tokens and auto-login tokens — to be scoped to an attacker-controlled domain, facilitating session hijacking. Details In include/functionsconfig.inc.php:726: This function is called during login with sensitive cookies: If an attacker can influence the Host header at login time (e.g. via MITM, reverse proxy misconfiguration, or load balancer), authentication cookies are issued scoped to the attacker's domain instead of the legitimate one. PoC Expected output: Impact - Session fixation — attacker pre-sets a cookie scoped to their domain, then tricks the victim into authenticating, inheriting the poisoned token - Token leakage — authorautologintoken scoped to wrong domain may be sent to attacker-controlled infrastructure - Privilege escalation — if admin logs in under a poisoned Host header, their…
Recommended action: Upgrade to 2.6.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.