CVE-2019-19830
published 2019-12-17CVE-2019-19830: _core_/plugins/medias in SPIP 3.2.x before 3.2.7 allows remote authenticated authors to inject content into the database.
PriorityP434medium6.5CVSS 3.1
AVNACLPRLUINSUCNIHAN
EPSS
1.27%
66.6th percentile
_core_/plugins/medias in SPIP 3.2.x before 3.2.7 allows remote authenticated authors to inject content into the database.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | spip | < spip 3.2.7-1 (bullseye) | spip 3.2.7-1 (bullseye) |
| spip | spip | >= 0 < 3.2.7-1 | 3.2.7-1 |
| spip | spip | >= 0 < 3.2.7-1 | 3.2.7-1 |
| spip | spip | >= 0 < 3.2.7-1 | 3.2.7-1 |
| spip | spip | >= 0 < 3.1.4-4~deb9u3build0.18.04.1 | 3.1.4-4~deb9u3build0.18.04.1 |
| spip | spip | >= 3.2.0 < 3.2.7 | 3.2.7 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:N/I:P/A:N
osv6.5MEDIUM
vendor_debian6.5MEDIUM
vendor_ubuntu6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-hrcf-gxm4-f848: _core_/plugins/medias in SPIP 3
ghsa_unreviewed·2022-05-24
CVE-2019-19830 [MEDIUM] CWE-20 GHSA-hrcf-gxm4-f848: _core_/plugins/medias in SPIP 3
_core_/plugins/medias in SPIP 3.2.x before 3.2.7 allows remote authenticated authors to inject content into the database.
OSV
spip vulnerabilities
osv·2020-09-24·CVSS 6.1
CVE-2019-16392 [MEDIUM] spip vulnerabilities
spip vulnerabilities
Youssouf Boulouiz discovered that SPIP incorrectly handled login error
messages. A remote attacker could potentially exploit this to conduct
cross-site scripting (XSS) attacks. (CVE-2019-16392)
Gilles Vincent discovered that SPIP incorrectly handled password reset
requests. A remote attacker could possibly use this issue to cause SPIP to
enumerate registered users. (CVE-2019-16394)
Guillaume Fahrner discovered that SPIP did not properly sanitize input. A
remote authenticated attacker could possibly use this issue to execute
arbitrary code on the host server. (CVE-2019-11071)
Sylvain Lefevre discovered that SPIP incorrectly handled user
authorization. A remote attacker could possibly use this issue to modify
and publish content and modify the database. (CVE-2019-163
OSV
CVE-2019-19830: _core_/plugins/medias in SPIP 3
osv·2019-12-17·CVSS 6.5
CVE-2019-19830 [MEDIUM] CVE-2019-19830: _core_/plugins/medias in SPIP 3
_core_/plugins/medias in SPIP 3.2.x before 3.2.7 allows remote authenticated authors to inject content into the database.
Ubuntu
SPIP vulnerabilities
vendor_ubuntu·2020-09-24·CVSS 6.1
CVE-2019-16392 [MEDIUM] SPIP vulnerabilities
Title: SPIP vulnerabilities
Summary: Several security issues were fixed in SPIP.
Youssouf Boulouiz discovered that SPIP incorrectly handled login error
messages. A remote attacker could potentially exploit this to conduct
cross-site scripting (XSS) attacks. (CVE-2019-16392)
Gilles Vincent discovered that SPIP incorrectly handled password reset
requests. A remote attacker could possibly use this issue to cause SPIP to
enumerate registered users. (CVE-2019-16394)
Guillaume Fahrner discovered that SPIP did not properly sanitize input. A
remote authenticated attacker could possibly use this issue to execute
arbitrary code on the host server. (CVE-2019-11071)
Sylvain Lefevre discovered that SPIP incorrectly handled user
authorization. A remote attacker could possibly use this issue to modi
Debian
CVE-2019-19830: spip - _core_/plugins/medias in SPIP 3.2.x before 3.2.7 allows remote authenticated aut...
vendor_debian·2019·CVSS 6.5
CVE-2019-19830 [MEDIUM] CVE-2019-19830: spip - _core_/plugins/medias in SPIP 3.2.x before 3.2.7 allows remote authenticated aut...
_core_/plugins/medias in SPIP 3.2.x before 3.2.7 allows remote authenticated authors to inject content into the database.
Scope: local
bullseye: resolved (fixed in 3.2.7-1)
forky: resolved (fixed in 3.2.7-1)
sid: resolved (fixed in 3.2.7-1)
trixie: resolved (fixed in 3.2.7-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://blog.spip.net/Mise-a-jour-CRITIQUE-de-securite-sortie-de-SPIP-3-2-7-SPIP-3-1-12.htmlhttps://git.spip.net/SPIP/spip/commit/8eb11ba132b92696eb34d606d71aa8edf40e0f69https://usn.ubuntu.com/4536-1/https://www.debian.org/security/2019/dsa-4583https://zone.spip.net/trac/spip-zone/changeset/118898/spip-zone/_core_/plugins/mediashttps://blog.spip.net/Mise-a-jour-CRITIQUE-de-securite-sortie-de-SPIP-3-2-7-SPIP-3-1-12.htmlhttps://git.spip.net/SPIP/spip/commit/8eb11ba132b92696eb34d606d71aa8edf40e0f69https://usn.ubuntu.com/4536-1/https://www.debian.org/security/2019/dsa-4583https://zone.spip.net/trac/spip-zone/changeset/118898/spip-zone/_core_/plugins/medias
2019-12-17
Published