CVE-2019-16393
published 2019-09-17CVE-2019-16393: SPIP before 3.1.11 and 3.2 before 3.2.5 mishandles redirect URLs in ecrire/inc/headers.php with a %0D, %0A, or %20 character.
PriorityP424medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
1.10%
62.1th percentile
SPIP before 3.1.11 and 3.2 before 3.2.5 mishandles redirect URLs in ecrire/inc/headers.php with a %0D, %0A, or %20 character.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | spip | < spip 3.2.5-1 (bullseye) | spip 3.2.5-1 (bullseye) |
| spip | spip | < 3.1.11 | 3.1.11 |
| spip | spip | >= 0 < 3.2.5-1 | 3.2.5-1 |
| spip | spip | >= 0 < 3.2.5-1 | 3.2.5-1 |
| spip | spip | >= 0 < 3.2.5-1 | 3.2.5-1 |
| spip | spip | >= 0 < 3.1.4-4~deb9u3build0.18.04.1 | 3.1.4-4~deb9u3build0.18.04.1 |
| spip | spip | >= 3.2.0 < 3.2.5 | 3.2.5 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
osv6.1MEDIUM
vendor_debian6.1MEDIUM
vendor_ubuntu6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-qgm5-36jw-p76q: SPIP before 3
ghsa_unreviewed·2022-05-24
CVE-2019-16393 [MEDIUM] CWE-601 GHSA-qgm5-36jw-p76q: SPIP before 3
SPIP before 3.1.11 and 3.2 before 3.2.5 mishandles redirect URLs in ecrire/inc/headers.php with a %0D, %0A, or %20 character.
OSV
spip vulnerabilities
osv·2020-09-24·CVSS 6.1
CVE-2019-16392 [MEDIUM] spip vulnerabilities
spip vulnerabilities
Youssouf Boulouiz discovered that SPIP incorrectly handled login error
messages. A remote attacker could potentially exploit this to conduct
cross-site scripting (XSS) attacks. (CVE-2019-16392)
Gilles Vincent discovered that SPIP incorrectly handled password reset
requests. A remote attacker could possibly use this issue to cause SPIP to
enumerate registered users. (CVE-2019-16394)
Guillaume Fahrner discovered that SPIP did not properly sanitize input. A
remote authenticated attacker could possibly use this issue to execute
arbitrary code on the host server. (CVE-2019-11071)
Sylvain Lefevre discovered that SPIP incorrectly handled user
authorization. A remote attacker could possibly use this issue to modify
and publish content and modify the database. (CVE-2019-163
OSV
CVE-2019-16393: SPIP before 3
osv·2019-09-17·CVSS 6.1
CVE-2019-16393 [MEDIUM] CVE-2019-16393: SPIP before 3
SPIP before 3.1.11 and 3.2 before 3.2.5 mishandles redirect URLs in ecrire/inc/headers.php with a %0D, %0A, or %20 character.
Ubuntu
SPIP vulnerabilities
vendor_ubuntu·2020-09-24·CVSS 6.1
CVE-2019-16392 [MEDIUM] SPIP vulnerabilities
Title: SPIP vulnerabilities
Summary: Several security issues were fixed in SPIP.
Youssouf Boulouiz discovered that SPIP incorrectly handled login error
messages. A remote attacker could potentially exploit this to conduct
cross-site scripting (XSS) attacks. (CVE-2019-16392)
Gilles Vincent discovered that SPIP incorrectly handled password reset
requests. A remote attacker could possibly use this issue to cause SPIP to
enumerate registered users. (CVE-2019-16394)
Guillaume Fahrner discovered that SPIP did not properly sanitize input. A
remote authenticated attacker could possibly use this issue to execute
arbitrary code on the host server. (CVE-2019-11071)
Sylvain Lefevre discovered that SPIP incorrectly handled user
authorization. A remote attacker could possibly use this issue to modi
Debian
CVE-2019-16393: spip - SPIP before 3.1.11 and 3.2 before 3.2.5 mishandles redirect URLs in ecrire/inc/h...
vendor_debian·2019·CVSS 6.1
CVE-2019-16393 [MEDIUM] CVE-2019-16393: spip - SPIP before 3.1.11 and 3.2 before 3.2.5 mishandles redirect URLs in ecrire/inc/h...
SPIP before 3.1.11 and 3.2 before 3.2.5 mishandles redirect URLs in ecrire/inc/headers.php with a %0D, %0A, or %20 character.
Scope: local
bullseye: resolved (fixed in 3.2.5-1)
forky: resolved (fixed in 3.2.5-1)
sid: resolved (fixed in 3.2.5-1)
trixie: resolved (fixed in 3.2.5-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://blog.spip.net/Mise-a-jour-CRITIQUE-de-securite-Sortie-de-SPIP-3-2-5-et-SPIP-3-1-11.htmlhttps://core.spip.net/issues/4362https://git.spip.net/SPIP/spip/commit/0b832408b0aabd5b94a81e261e9413c0f31a19f1https://lists.debian.org/debian-lts-announce/2019/10/msg00038.htmlhttps://seclists.org/bugtraq/2019/Sep/40https://usn.ubuntu.com/4536-1/https://www.debian.org/security/2019/dsa-4532https://blog.spip.net/Mise-a-jour-CRITIQUE-de-securite-Sortie-de-SPIP-3-2-5-et-SPIP-3-1-11.htmlhttps://core.spip.net/issues/4362https://git.spip.net/SPIP/spip/commit/0b832408b0aabd5b94a81e261e9413c0f31a19f1https://lists.debian.org/debian-lts-announce/2019/10/msg00038.htmlhttps://seclists.org/bugtraq/2019/Sep/40https://usn.ubuntu.com/4536-1/https://www.debian.org/security/2019/dsa-4532
2019-09-17
Published