PT-2019-5067 · Spip+1 · Spip+1

Guillaume Fahrner · Publicado 2019-04-10 · Atualizado 2020-09-28 · CVE-2019-11071

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SPIP versions 3.1 through 3.1.9 SPIP versions 3.2 through 3.2.3

Description The issue is related to insufficient input validation in the content management system, allowing an attacker to execute arbitrary code. This can be exploited by authenticated visitors, potentially leading to the execution of arbitrary code on the host server due to the mishandling of var memotri.

Recommendations For SPIP versions 3.1 through 3.1.9, update to version 3.1.10 or later. For SPIP versions 3.2 through 3.2.3, update to version 3.2.4 or later.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2020-01709

CVE-2019-11071

DSA-4429-1

USN-4536-1

Produtos afetados

Spip

Ubuntu

Referências · 26

• https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-11071.html · Nota
• https://ubuntu.com/security/CVE-2019-16391 · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-4536-1 · Aviso do Fabricante
• ❌ https://github.com/spip/SPIP/commit/824d17f424bf77d17af89c18c3dc807a3199567e · Correção, Deleted
• https://ubuntu.com/security/CVE-2019-19830 · Aviso do Fabricante
• https://osv.dev/vulnerability/DSA-4429-1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-11071 · Nota de Segurança
• ❌ https://github.com/spip/SPIP/compare/1e3872c...9861a47 · Nota, Deleted
• ❌ https://github.com/spip/SPIP/commit/3ef87c525bc0768c926646f999a54222b37b5d36 · Correção, Deleted
• https://ubuntu.com/security/CVE-2017-15736 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-11071 · Aviso do Fabricante
• https://blog.spip.net/Mise-a-jour-CRITIQUE-de-securite-Sortie-de-SPIP-3-1-10-et-SPIP-3-2-4.html · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-11071 · Aviso do Fabricante
• https://blog.spip.net/Mise-a-jour-CRITIQUE-de-securite-Sortie-de-SPIP-3-1-10-et-SPIP-3-2-4.html?lang=fr · Nota
• https://security-tracker.debian.org/tracker/CVE-2019-11071 · Aviso do Fabricante