CVE-2017-15736
published 2017-10-22CVE-2017-15736: Cross-site scripting (XSS) vulnerability (stored) in SPIP before 3.1.7 allows remote attackers to inject arbitrary web script or HTML via a crafted string, as…
PriorityP423medium6.1CVSS 3.0
AVNACLPRNUIRSCCLILAN
EPSS
0.99%
58.8th percentile
Cross-site scripting (XSS) vulnerability (stored) in SPIP before 3.1.7 allows remote attackers to inject arbitrary web script or HTML via a crafted string, as demonstrated by a PGP field, related to prive/objets/contenu/auteur.html and ecrire/inc/texte_mini.php.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | spip | < spip 3.1.4-4 (bullseye) | spip 3.1.4-4 (bullseye) |
| spip | spip | <= 3.1.6 | — |
| spip | spip | >= 0 < 3.1.4-4 | 3.1.4-4 |
| spip | spip | >= 0 < 3.1.4-4 | 3.1.4-4 |
| spip | spip | >= 0 < 3.1.4-4 | 3.1.4-4 |
| spip | spip | >= 0 < 3.1.4-4~deb9u3build0.18.04.1 | 3.1.4-4~deb9u3build0.18.04.1 |
CVSS provenance
nvdv3.06.1MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv6.1MEDIUM
vendor_debian6.1MEDIUM
vendor_ubuntu6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-mfv3-xjr8-9xpg: Cross-site scripting (XSS) vulnerability (stored) in SPIP before 3
ghsa_unreviewed·2022-05-13
CVE-2017-15736 [MEDIUM] CWE-79 GHSA-mfv3-xjr8-9xpg: Cross-site scripting (XSS) vulnerability (stored) in SPIP before 3
Cross-site scripting (XSS) vulnerability (stored) in SPIP before 3.1.7 allows remote attackers to inject arbitrary web script or HTML via a crafted string, as demonstrated by a PGP field, related to prive/objets/contenu/auteur.html and ecrire/inc/texte_mini.php.
OSV
spip vulnerabilities
osv·2020-09-24·CVSS 6.1
CVE-2019-16392 [MEDIUM] spip vulnerabilities
spip vulnerabilities
Youssouf Boulouiz discovered that SPIP incorrectly handled login error
messages. A remote attacker could potentially exploit this to conduct
cross-site scripting (XSS) attacks. (CVE-2019-16392)
Gilles Vincent discovered that SPIP incorrectly handled password reset
requests. A remote attacker could possibly use this issue to cause SPIP to
enumerate registered users. (CVE-2019-16394)
Guillaume Fahrner discovered that SPIP did not properly sanitize input. A
remote authenticated attacker could possibly use this issue to execute
arbitrary code on the host server. (CVE-2019-11071)
Sylvain Lefevre discovered that SPIP incorrectly handled user
authorization. A remote attacker could possibly use this issue to modify
and publish content and modify the database. (CVE-2019-163
OSV
CVE-2017-15736: Cross-site scripting (XSS) vulnerability (stored) in SPIP before 3
osv·2017-10-22·CVSS 6.1
CVE-2017-15736 [MEDIUM] CVE-2017-15736: Cross-site scripting (XSS) vulnerability (stored) in SPIP before 3
Cross-site scripting (XSS) vulnerability (stored) in SPIP before 3.1.7 allows remote attackers to inject arbitrary web script or HTML via a crafted string, as demonstrated by a PGP field, related to prive/objets/contenu/auteur.html and ecrire/inc/texte_mini.php.
Ubuntu
SPIP vulnerabilities
vendor_ubuntu·2020-09-24·CVSS 6.1
CVE-2019-16392 [MEDIUM] SPIP vulnerabilities
Title: SPIP vulnerabilities
Summary: Several security issues were fixed in SPIP.
Youssouf Boulouiz discovered that SPIP incorrectly handled login error
messages. A remote attacker could potentially exploit this to conduct
cross-site scripting (XSS) attacks. (CVE-2019-16392)
Gilles Vincent discovered that SPIP incorrectly handled password reset
requests. A remote attacker could possibly use this issue to cause SPIP to
enumerate registered users. (CVE-2019-16394)
Guillaume Fahrner discovered that SPIP did not properly sanitize input. A
remote authenticated attacker could possibly use this issue to execute
arbitrary code on the host server. (CVE-2019-11071)
Sylvain Lefevre discovered that SPIP incorrectly handled user
authorization. A remote attacker could possibly use this issue to modi
Debian
CVE-2017-15736: spip - Cross-site scripting (XSS) vulnerability (stored) in SPIP before 3.1.7 allows re...
vendor_debian·2017·CVSS 6.1
CVE-2017-15736 [MEDIUM] CVE-2017-15736: spip - Cross-site scripting (XSS) vulnerability (stored) in SPIP before 3.1.7 allows re...
Cross-site scripting (XSS) vulnerability (stored) in SPIP before 3.1.7 allows remote attackers to inject arbitrary web script or HTML via a crafted string, as demonstrated by a PGP field, related to prive/objets/contenu/auteur.html and ecrire/inc/texte_mini.php.
Scope: local
bullseye: resolved (fixed in 3.1.4-4)
forky: resolved (fixed in 3.1.4-4)
sid: resolved (fixed in 3.1.4-4)
trixie: resolved (fixed in 3.1.4-4)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2017-10-22
Published