Analyst readout for executives and security teams
Plain-English summary
CVE-2015-2289 is an authenticated cross-site scripting issue in Serendipity CMS before 2.0.1. A user with editor access could place script or HTML into a category name during category creation. The main business risk is abuse of trusted CMS access to affect administrator sessions or content workflows.
Executive priority
Treat this as a targeted CMS administrative risk, not an internet-wide emergency. Prioritize remediation where Serendipity is public-facing, has multiple editor accounts, or supports business-critical publishing.
Technical view
The flaw is in templates/2k11/admin/entries.tpl and involves insufficient handling of the serendipity[cat][name] parameter in serendipity_admin.php when creating a category. Sources identify Serendipity 2.0 as vulnerable and Serendipity 2.0.1 as the fixed release. No CVSS vector is provided in the bundle.
Likely exposure
Exposure is likely limited to Serendipity CMS installations older than 2.0.1 where remote authenticated editor accounts can access category creation in the admin interface.
Exploitation context
The vulnerability was publicly disclosed in March 2015 through mailing-list and security advisory references. The provided sources do not show CISA KEV listing or confirmed active exploitation.
Researcher notes
Evidence supports authenticated XSS through category creation in Serendipity before 2.0.1. The bundle does not include CVSS, CWE, detailed exploit reliability, or confirmed exploitation. Avoid assuming broader Serendipity versions beyond the stated before-2.0.1 range.
Mitigation direction
- Upgrade Serendipity CMS to version 2.0.1 or later.
- Restrict editor accounts until the upgrade is complete.
- Review category names created by editor accounts before remediation.
- Check vendor release notes and commit history for the applied fix.
Validation and detection
- Inventory Serendipity installations and confirm exact versions.
- Identify any installations running Serendipity before 2.0.1.
- Verify the relevant upstream fix is present in deployed code.
- Review admin audit data for suspicious category creation activity.
Public sources used
Based on public source material and reviewed before publication.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2015-2289 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- 20150313 Serendipity CMS - XSS Vulnerability in Version 2.0CVE reference · mailing-list, x_refsource_BUGTRAQ
- http://packetstormsecurity.com/files/130838/Serendipity-CMS-2.0-Cross-Site-Scripting.htmlCVE reference · x_refsource_MISC
- [oss-security] 20150314 CVE-2015-2289: Serendipity CMS cross-site scripting vulnerability in 2.0 versionCVE reference · mailing-list, x_refsource_MLIST
- http://blog.s9y.org/archives/263-Serendipity-2.0.1-released.htmlCVE reference · x_refsource_CONFIRM
- https://github.com/s9y/Serendipity/commit/a30886d3bb9d8eeb6698948864c77caaa982435dCVE reference · x_refsource_CONFIRM
- 1031961CVE reference · vdb-entry, x_refsource_SECTRACK
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.