A vulnerability classified as critical was found in SPIP up to 3.2.17/4.0.9/4.1.7/4.2.0 (Content Management System). This vulnerability affects an unknown part of the component Form Value Handler. The manipulation with an unknown input leads to a deserialization vulnerability. The CWE definition for the vulnerability is CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1.

The weakness was disclosed 03/01/2023 as 5aedf49b89415a4df3eb775eee3801a2b4b88266. The advisory is available at git.spip.net. This vulnerability was named CVE-2023-27372 since 02/28/2023. The technical details are unknown and an exploit is not available.

Upgrading to version 3.2.18, 4.0.10, 4.1.8 or 4.2.1 eliminates this vulnerability. Applying the patch 5aedf49b89415a4df3eb775eee3801a2b4b88266 is able to eliminate this problem. The bugfix is ready for download at git.spip.net. The best possible mitigation is suggested to be upgrading to the latest version.

Productinfo

Type

• Content Management System

Name

• SPIP

Version

• 3.2.0
• 3.2.1
• 3.2.2
• 3.2.3
• 3.2.4
• 3.2.5
• 3.2.6
• 3.2.7
• 3.2.8
• 3.2.9
• 3.2.10
• 3.2.11
• 3.2.12
• 3.2.13
• 3.2.14
• 3.2.15
• 3.2.16
• 3.2.17
• 4.0
• 4.0.0
• 4.0.1
• 4.0.2
• 4.0.3
• 4.0.4
• 4.0.5
• 4.0.6
• 4.0.7
• 4.0.8
• 4.0.9
• 4.1
• 4.1.0
• 4.1.1
• 4.1.2
• 4.1.3
• 4.1.4
• 4.1.5
• 4.1.6
• 4.1.7
• 4.2

License

• free

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion