PT-2019-5067 · Spip+1 · Spip+1

Guillaume Fahrner · Published 2019-04-10 · Updated 2020-09-28 · CVE-2019-11071

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SPIP versions 3.1 through 3.1.9 SPIP versions 3.2 through 3.2.3

Description The issue is related to insufficient input validation in the content management system, allowing an attacker to execute arbitrary code. This can be exploited by authenticated visitors, potentially leading to the execution of arbitrary code on the host server due to the mishandling of var memotri.

Recommendations For SPIP versions 3.1 through 3.1.9, update to version 3.1.10 or later. For SPIP versions 3.2 through 3.2.3, update to version 3.2.4 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2020-01709

CVE-2019-11071

DSA-4429-1

USN-4536-1

Affected Products

Spip

Ubuntu

References · 26

• https://ubuntu.com/security/CVE-2019-16391 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4536-1 · Vendor Advisory
• ❌ https://github.com/spip/SPIP/commit/824d17f424bf77d17af89c18c3dc807a3199567e · Patch, Deleted
• https://ubuntu.com/security/CVE-2019-19830 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4429-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11071 · Security Note
• ❌ https://github.com/spip/SPIP/commit/3ef87c525bc0768c926646f999a54222b37b5d36 · Patch, Deleted
• https://ubuntu.com/security/CVE-2017-15736 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-11071 · Vendor Advisory
• https://blog.spip.net/Mise-a-jour-CRITIQUE-de-securite-Sortie-de-SPIP-3-1-10-et-SPIP-3-2-4.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-11071 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-11071 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-16394 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-11071 · Security Note
• https://ubuntu.com/security/CVE-2019-16393 · Vendor Advisory