PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-5474 S9y CVE debrief

CVE-2017-5474 is an open redirect vulnerability in Serendipity through 2.0.5, located in comment.php. An attacker can supply a URL in the HTTP Referer header and cause users to be redirected to an arbitrary website, which can be used for phishing. The issue was publicly disclosed on 2017-01-14 and is rated medium severity (CVSS 6.1).

Vendor
S9y
Product
Serendipity
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-14
Original CVE updated
2026-05-13
Advisory published
2017-01-14
Advisory updated
2026-05-13

Who should care

Administrators and security teams running Serendipity instances through 2.0.5, especially public-facing sites that expose comment.php or accept user traffic from untrusted networks.

Technical summary

The NVD description identifies an open redirect in comment.php. The vulnerable behavior trusts a URL associated with the HTTP Referer header and can redirect a victim to an attacker-chosen destination. NVD maps the issue to CWE-601 and lists affected Serendipity versions through 2.0.5. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) indicates remote exploitation without privileges, but with required user interaction and limited confidentiality/integrity impact.

Defensive priority

Moderate priority. Patch promptly if you run a vulnerable Serendipity version, because open redirects are commonly used to support phishing and social engineering, and a fix reference is available in the supplied patch commit.

Recommended defensive actions

  • Upgrade Serendipity to a version newer than 2.0.5 that includes the referenced fix.
  • Review comment.php and related redirect handling to ensure untrusted Referer values are never used as redirect destinations.
  • Add automated checks or tests for open redirect behavior so future changes do not reintroduce CWE-601 issues.
  • Monitor logs and user reports for suspicious redirect chains or phishing complaints involving the application.
  • If immediate upgrading is not possible, limit exposure of the affected workflow and apply compensating controls to reduce user trust in external redirects.

Evidence notes

Based on the supplied NVD record and references: the description states an open redirect in comment.php, exploitable via a URL in the HTTP Referer header; the affected CPE ends at version 2.0.5; CWE-601 is listed; and the CVSS vector is CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The supplied references include a SecurityFocus advisory entry and a GitHub commit marked as a patch reference. No exploit code or unsupported impact claims are included.

Sources and references

Verified primary and authoritative sources

  • CVE-2017-5474 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2017-5474

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2017-5474 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2017-5474

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.