SPIP 4.4.7 and earlier allows malicious code to run in the admin area

Summary

SPIP, a web software, has a security flaw that allows an attacker to inject malicious code into the admin area, potentially allowing them to take control of sensitive parts of the site. This could lead to unauthorized changes or data theft. To fix this, update to SPIP 4.4.8 or later.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
spip	spip	> 4.4.0 , <= 4.4.8	–

Original title

SPIP before 4.4.8 allows cross-site scripting (XSS) in the private area via malicious iframe tags. The application does not properly sandbox or escape iframe content in the back-office, allowing an...

Original description

SPIP before 4.4.8 allows cross-site scripting (XSS) in the private area via malicious iframe tags. The application does not properly sandbox or escape iframe content in the back-office, allowing an attacker to inject and execute malicious scripts. The fix adds a sandbox attribute to iframe tags in the private area. This vulnerability is not mitigated by the SPIP security screen.

nvd CVSS3.1 6.1

nvd CVSS4.0 5.1

Vulnerability type

CWE-79 Cross-site Scripting (XSS)

https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-8.html Release Notes Vendor Advisory
https://git.spip.net/spip/spip Product
https://www.vulncheck.com/advisories/spip-cross-site-scripting-via-iframe-tags-i... Third Party Advisory