PT-2019-4103 · Spip+1 · Spip+1

Published 2019-09-17 · Updated 2022-05-03 · CVE-2019-16394

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions SPIP versions prior to 3.1.11 SPIP versions 3.2 prior to 3.2.5

Description The issue is related to the disclosure of user information. It might allow a remote attacker to gain unauthorized access to information. The problem is associated with different error messages provided by the password-reminder page, depending on whether an e-mail address exists, which could help attackers enumerate subscribers.

Recommendations For SPIP versions prior to 3.1.11, update to version 3.1.11 or later. For SPIP versions 3.2 prior to 3.2.5, update to version 3.2.5 or later.

Exploit

Fix

Information Disclosure

Side Channel Attack

Weakness Enumeration

CWE-200

CWE-203

Related Identifiers

BDU:2019-04672

CVE-2019-16394

DLA-1975-1

DSA-4532-1

USN-4536-1

Affected Products

Spip

Ubuntu

References · 26

• 🔥 https://core.spip.net/issues/4171 · Exploit
• https://ubuntu.com/security/CVE-2019-16391 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4532-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4536-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-19830 · Vendor Advisory
• https://debian.org/security/2019/dsa-4532 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16394 · Security Note
• https://ubuntu.com/security/CVE-2017-15736 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-04672 · Security Note
• https://ubuntu.com/security/CVE-2019-16394 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-16394 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-16393 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-16392 · Vendor Advisory
• https://blog.spip.net/Mise-a-jour-CRITIQUE-de-securite-Sortie-de-SPIP-3-2-5-et-SPIP-3-1-11.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-16394 · Vendor Advisory