PT-2019-4104 · Spip+1 · Spip+1

Christophe Laffont · Published 2019-09-17 · Updated 2023-02-13 · CVE-2019-16393

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SPIP versions prior to 3.1.11 SPIP versions prior to 3.2.5

Description The issue is related to the mishandling of redirect URLs in the ecrire/inc/headers.php file, specifically when a %0D, %0A, or %20 character is present. This can lead to a potential redirect to an unreliable site, allowing a remote attacker to compromise data integrity.

Recommendations For SPIP versions prior to 3.1.11, update to version 3.1.11 or later. For SPIP versions prior to 3.2.5, update to version 3.2.5 or later.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

BDU:2019-04673

CVE-2019-16393

DLA-1975-1

DSA-4532-1

USN-4536-1

Affected Products

Spip

Ubuntu

References · 25

• https://ubuntu.com/security/CVE-2019-16391 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4532-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4536-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-19830 · Vendor Advisory
• https://debian.org/security/2019/dsa-4532 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-16393 · Security Note
• https://osv.dev/vulnerability/CVE-2019-16393 · Vendor Advisory
• https://core.spip.net/issues/4362 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-15736 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16393 · Security Note
• https://ubuntu.com/security/CVE-2019-16394 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-16393 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-16393 · Vendor Advisory
• https://git.spip.net/SPIP/spip/commit/0b832408b0aabd5b94a81e261e9413c0f31a19f1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-16393 · Vendor Advisory