Description
Cross-site scripting (XSS) vulnerability in the author page (prive/formulaires/editer_auteur.php) in SPIP before 2.1.24 and 3.0.x before 3.0.12 allows remote attackers to inject arbitrary web script or HTML via the url_site parameter.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | spip | 2.1.24-1 | — |
| Debian 13 | spip | 2.1.24-1 | — |
| Debian 7 | spip | 2.1.17-1+deb7u2 | DSA-2794-1 |
| Debian 6.0 | spip | 2.1.1-3squeeze7 | DSA-2794-1 |
Advisories 1
- DSA-2794-1 spip - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-2794 vendor-advisory
- http://core.spip.org/projects/spip/repository/revisions/20880
- http://www.spip.net/fr_article5646.html
- 1029317 vdb-entry
- [oss-security] 20131110 Re: CVE Request: multiple vulnerabilities in spip mailing-list
- 55551 third-party-advisory
- http://www.spip.net/fr_article5648.html
- http://core.spip.org/projects/spip/repository/revisions/20879