Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.4
CVE-2021-44120: SPIP 4.0.0 allows hackers to inject malicious code on public pages
CVE-2021-44120 · published 4 years ago
Summary
A security flaw in SPIP 4.0.0 allows a website editor to add malicious code to their own information, which can then be executed on public pages. This can lead to a security risk for visitors to the site. To protect your site, update to a patched version of SPIP as soon as possible.
What to do
- Update canonical spip to version 3.1.4-4~deb9u5build0.18.04.1.
- Update canonical spip to version 3.2.7-1ubuntu0.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:Pro:16.04:LTS | canonical | spip | All versions |
| Ubuntu:18.04:LTS | canonical | spip |
< 3.1.4-4~deb9u5build0.18.04.1 Fix: upgrade to 3.1.4-4~deb9u5build0.18.04.1
|
| Ubuntu:20.04:LTS | canonical | spip |
< 3.2.7-1ubuntu0.1 Fix: upgrade to 3.2.7-1ubuntu0.1
|
| – | spip | spip |
4.0.0 cpe:2.3:a:spip:spip:4.0.0:*:*:*:*:*:*:* |
Original advisory text
SPIP 4.0.0 is affected by a Cross Site Scripting (XSS) vulnerability in ecrire/public/interfaces.php, adding the function safehtml to the vulnerable fields. An editor is able to modify his personal...
SPIP 4.0.0 is affected by a Cross Site Scripting (XSS) vulnerability in ecrire/public/interfaces.php, adding the function safehtml to the vulnerable fields. An editor is able to modify his personal information. If the editor has an article written and available, when a user goes to the public site and wants to read the author's information, the malicious code will be executed. The "Who are you" and "Website Name" fields are vulnerable.
References
- https://ubuntu.com/security/CVE-2021-44120 Third Party Advisory
- https://ubuntu.com/security/notices/USN-5482-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-5482-2 Vendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2021-44120 Third Party Advisory
- https://git.spip.net/spip/spip/commit/d548391d799387d1e93cf1a369d385c72f7d5c81 Patch Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published26 Jan 2022
Updated4 Nov 2026
First seen7 Apr 2026
Track software like this
Free during beta