SPIP Before 4.4.9: Private Area XSS Attack Risk

Summary

An attacker can inject malicious code into the private area of SPIP, potentially allowing them to steal sensitive information or take control of user accounts. This is because the software doesn't properly protect against malicious input in certain areas. To stay safe, update to version 4.4.9 or apply a patch to fix the issue.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
spip	spip	> 4.4.0 , <= 4.4.9	–

Original title

SPIP before 4.4.9 allows Cross-Site Scripting (XSS) in the private area, complementing an incomplete fix from SPIP 4.4.8. The echappe_anti_xss() function was not systematically applied to input, fo...

Original description

SPIP before 4.4.9 allows Cross-Site Scripting (XSS) in the private area, complementing an incomplete fix from SPIP 4.4.8. The echappe_anti_xss() function was not systematically applied to input, form, button, and anchor (a) HTML tags, allowing an attacker to inject malicious scripts through these elements. This vulnerability is not mitigated by the SPIP security screen.

nvd CVSS3.1 6.1

nvd CVSS4.0 4.8

Vulnerability type

CWE-79 Cross-site Scripting (XSS)

https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-9.html Release Notes Vendor Advisory
https://git.spip.net/spip/spip Product
https://www.vulncheck.com/advisories/spip-cross-site-scripting-in-private-area-i... Third Party Advisory