Skip to content
OpenAdvisories
Unscored USN-4536-1 7 CVEs

spip vulnerabilities

Published Sep 24, 2020 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

Youssouf Boulouiz discovered that SPIP incorrectly handled login error
messages. A remote attacker could potentially exploit this to conduct
cross-site scripting (XSS) attacks. (CVE-2019-16392)

Gilles Vincent discovered that SPIP incorrectly handled password reset
requests. A remote attacker could possibly use this issue to cause SPIP to
enumerate registered users. (CVE-2019-16394)

Guillaume Fahrner discovered that SPIP did not properly sanitize input. A
remote authenticated attacker could possibly use this issue to execute
arbitrary code on the host server. (CVE-2019-11071)

Sylvain Lefevre discovered that SPIP incorrectly handled user
authorization. A remote attacker could possibly use this issue to modify
and publish content and modify the database. (CVE-2019-16391)

It was discovered that SPIP did not properly sanitize input. A remote
attacker could, through cross-site scripting (XSS) and PHP injection,
exploit this to inject arbitrary web script or HTML. (CVE-2017-15736)

Alexis Zucca discovered that SPIP incorrectly handled the media plugin. A
remote authenticated attacker could possibly use this issue to write to
the database. (CVE-2019-19830)

Christophe Laffont discovered that SPIP incorrectly handled redirect URLs.
An attacker could use this issue to cause SPIP to crash, resulting in a
denial of service, or possibly execute arbitrary code. (CVE-2019-16393)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 18.04 LTS 18.04:LTS spip 3.1.4-4~deb9u3build0.18.04.1

Vulnerabilities 7

  • Unscored —
    CVE-2017-15736

    Cross-site scripting (XSS) vulnerability (stored) in SPIP before 3.1.7 allows remote attackers to inject arbitrary web …

    spip spip Debian Ubuntu
  • Unscored —
    CVE-2019-11071

    SPIP 3.1 before 3.1.10 and 3.2 before 3.2.4 allows authenticated visitors to execute arbitrary code on the host server …

    spip spip Debian Ubuntu
  • Unscored —
    CVE-2019-16391

    SPIP before 3.1.11 and 3.2 before 3.2.5 allows authenticated visitors to modify any published content and execute other…

    spip spip Debian Ubuntu
  • Unscored —
    CVE-2019-16392

    SPIP before 3.1.11 and 3.2 before 3.2.5 allows prive/formulaires/login.php XSS via error messages.

    spip spip Debian Ubuntu
  • Unscored —
    CVE-2019-16393

    SPIP before 3.1.11 and 3.2 before 3.2.5 mishandles redirect URLs in ecrire/inc/headers.php with a %0D, %0A, or %20 char…

    spip spip Debian Ubuntu
  • Unscored —
    CVE-2019-16394 Public exploit

    SPIP before 3.1.11 and 3.2 before 3.2.5 provides different error messages from the password-reminder page depending on …

    spip spip Debian Ubuntu
  • Unscored —
    CVE-2019-19830

    _core_/plugins/medias in SPIP 3.2.x before 3.2.7 allows remote authenticated authors to inject content into the databas…

    spip Debian

References

  • report
    https://ubuntu.com/security/CVE-2017-15736
  • report
    https://ubuntu.com/security/CVE-2019-11071
  • report
    https://ubuntu.com/security/CVE-2019-16391
  • report
    https://ubuntu.com/security/CVE-2019-16392
  • report
    https://ubuntu.com/security/CVE-2019-16393
  • report
    https://ubuntu.com/security/CVE-2019-16394
  • report
    https://ubuntu.com/security/CVE-2019-19830