SPIP 4.4.8 and earlier allows malicious syndication URLs in private area

Summary

SPIP, a content management system, has a security flaw that allows an attacker to inject malicious code into the system. An attacker can exploit this vulnerability by setting a malicious link in a syndicated site. This could allow them to execute code on the system when other administrators view the site details. To protect your system, update to version 4.4.9 or later.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
spip	spip	> 4.4.0 , <= 4.4.9	–

Original title

SPIP before 4.4.9 allows Stored Cross-Site Scripting (XSS) via syndicated sites in the private area. The #URL_SYNDIC output is not properly sanitized on the private syndicated site page, allowing a...

Original description

SPIP before 4.4.9 allows Stored Cross-Site Scripting (XSS) via syndicated sites in the private area. The #URL_SYNDIC output is not properly sanitized on the private syndicated site page, allowing an attacker who can set a malicious syndication URL to inject persistent scripts that execute when other administrators view the syndicated site details.

nvd CVSS3.1 6.4

nvd CVSS4.0 5.1

Vulnerability type

CWE-79 Cross-site Scripting (XSS)

https://git.spip.net/spip/spip Product
https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-9.html Vendor Advisory Release Notes
https://www.vulncheck.com/advisories/spip-stored-cross-site-scripting-via-syndic... Third Party Advisory