PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-5474 S9y CVE debrief

CVE-2017-5474 is an open redirect vulnerability in Serendipity through 2.0.5, located in comment.php. An attacker can supply a URL in the HTTP Referer header and cause users to be redirected to an arbitrary website, which can be used for phishing. The issue was publicly disclosed on 2017-01-14 and is rated medium severity (CVSS 6.1).

Vendor
S9y
Product
CVE-2017-5474
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-14
Original CVE updated
2026-05-13
Advisory published
2017-01-14
Advisory updated
2026-05-13

Who should care

Administrators and security teams running Serendipity instances through 2.0.5, especially public-facing sites that expose comment.php or accept user traffic from untrusted networks.

Technical summary

The NVD description identifies an open redirect in comment.php. The vulnerable behavior trusts a URL associated with the HTTP Referer header and can redirect a victim to an attacker-chosen destination. NVD maps the issue to CWE-601 and lists affected Serendipity versions through 2.0.5. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) indicates remote exploitation without privileges, but with required user interaction and limited confidentiality/integrity impact.

Defensive priority

Moderate priority. Patch promptly if you run a vulnerable Serendipity version, because open redirects are commonly used to support phishing and social engineering, and a fix reference is available in the supplied patch commit.

Recommended defensive actions

  • Upgrade Serendipity to a version newer than 2.0.5 that includes the referenced fix.
  • Review comment.php and related redirect handling to ensure untrusted Referer values are never used as redirect destinations.
  • Add automated checks or tests for open redirect behavior so future changes do not reintroduce CWE-601 issues.
  • Monitor logs and user reports for suspicious redirect chains or phishing complaints involving the application.
  • If immediate upgrading is not possible, limit exposure of the affected workflow and apply compensating controls to reduce user trust in external redirects.

Evidence notes

Based on the supplied NVD record and references: the description states an open redirect in comment.php, exploitable via a URL in the HTTP Referer header; the affected CPE ends at version 2.0.5; CWE-601 is listed; and the CVSS vector is CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The supplied references include a SecurityFocus advisory entry and a GitHub commit marked as a patch reference. No exploit code or unsupported impact claims are included.

Official resources

Publicly disclosed on 2017-01-14. The supplied record shows a later metadata modification on 2026-05-13; that date reflects record maintenance, not the original vulnerability disclosure.