# CVE-2017-5474: Serendipity open redirect in comment.php

Source: https://junglewise.ai/threats/cve-2017-5474-serendipity-open-redirect-in-comment-php  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-14. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2017-5474 · Severity: medium · CVSS 6.1 · Published 2017-01-14

Serendipity, a popular open-source PHP blogging engine, contains a security flaw that allows attackers to redirect users to malicious websites. By tricking a user into clicking a specially crafted link, an attacker can send them to a fraudulent site that looks legitimate, increasing the success of phishing attacks and potentially leading to credential theft. This issue affects the comment management component of the software.

Technologies: [Serendipity](https://junglewise.ai/threats/technologies/serendipity). Vendors: [Serendipity](https://junglewise.ai/threats/vendors/serendipity).

## Quick answers

**Is CVE-2017-5474 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2017-5474 being exploited in the wild.

**How severe is CVE-2017-5474?** Medium severity, with a CVSS score of 6.1, published 14 January 2017.

**Which products and versions are affected?** Serendipity Through 2.0.5.

**Is there a fix for CVE-2017-5474?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2017-5474 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2017-5474?** Check whether you run Serendipity at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An open redirect vulnerability exists in 'comment.php' within Serendipity versions up to and including 2.0.5. The application fails to properly validate the 'HTTP_REFERER' header before using it in a 302 redirect location. A remote attacker can exploit this by inducing a user to visit a crafted URL that triggers a redirect to an external, untrusted domain. This is primarily used to facilitate phishing campaigns or bypass security filters that trust the original domain. The fix involves implementing a check to ensure the referrer matches the 'HTTP_HOST' of the blog.

## Affected products

- s9y Serendipity Through 2.0.5

## Timeline

- 2017-01-14: disclosed
- 2017-01-14: advisory

## References

- [http://www.securityfocus.com/bid/95652](http://www.securityfocus.com/bid/95652)
- [https://github.com/s9y/Serendipity/commit/6285933470bab2923e4573b5d54ba9a32629b0cd](https://github.com/s9y/Serendipity/commit/6285933470bab2923e4573b5d54ba9a32629b0cd)

## Related threats

- [Serendipity open redirect in exit.php](https://junglewise.ai/threats/cve-2026-67350-serendipity-open-redirect-in-exit-php)
- [Serendipity privilege escalation via authentication context confusion](https://junglewise.ai/threats/cve-2026-67351-serendipity-privilege-escalation-via-authentication-context)
- [Serendipity Host Header Injection in serendipity_setCookie](https://junglewise.ai/threats/cve-2026-39963-serendipity-host-header-injection-in-serendipity-setcookie)
- [Serendipity SQL injection in include/functions_entries.inc.php](https://junglewise.ai/threats/cve-2017-5609-serendipity-sql-injection-in-include-functions-entries-inc-php)
- [Serendipity CSRF in plugin installation](https://junglewise.ai/threats/cve-2017-5476-serendipity-csrf-in-plugin-installation)