CVE-2004-1620

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 8.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2004-10-21 · updated 2026-06-16

Description

CRLF injection vulnerability in Serendipity before 0.7rc1 allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML content from the server via the url parameter in (1) index.php and (2) exit.php, or (3) the HTTP Referer field in comment.php.

Affected products

s9y Serendipity: 0.3, 0.4, 0.5, 0.5_pl1, 0.6, 0.6_pl1 (+8)

References

http://cvs.sourceforge.net/viewcvs.py/php-blog/serendipity/comment.php?rev=1.49&view=markup
http://cvs.sourceforge.net/viewcvs.py/php-blog/serendipity/exit.php?rev=1.10&view=markup
http://cvs.sourceforge.net/viewcvs.py/php-blog/serendipity/index.php?rev=1.52&view=markup
http://marc.info/?l=bugtraq&m=109841283115808&w=2
http://secunia.com/advisories/12909/
http://securitytracker.com/id?1011864
http://sourceforge.net/project/shownotes.php?release_id=276694
http://www.osvdb.org/11013
http://www.osvdb.org/11038
http://www.osvdb.org/11039
http://www.s9y.org/5.html
http://www.securityfocus.com/bid/11497

Get alerted when CVE-2004-1620 or the next vulnerability affects your stack