CVE-2009-2165: Serendipitynz Serene Bach

High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days.

SerendipityNZ (aka SimpleBoxes) Serene Bach 2.20R and earlier, and 3.00 beta023 and earlier 3.x versions, uses a predictable session id, which makes it easier for remote attackers to hijack sessions via a modified id.

Affected products

• Serendipitynz Serene Bach: up to and including 2.20r; version 1.18r only; version 1.19r only; version 2.05r only; version 2.08d only; version 2.09r only; …

Published 2009-06-22. Last modified 2026-06-16.