Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

SPIP versions before 4.2.1 allow attackers to run code

CVE-2023-27372 · published 3 years ago
Summary

The SPIP publishing system for Debian releases prior to version 4.2.1 mishandles data from public forms, letting an attacker send specially crafted input that can execute commands on the server. This could let an unauthorized user take control of the website or access confidential information. Upgrade to SPIP 3.2.18, 4.0.10, 4.1.8, or 4.2.1 or later to fix the problem.

What to do
  • Update debian spip to version 4.1.8+dfsg-1.
Affected software
Ecosystem VendorProductAffected versions
Debian:13 debian spip < 4.1.8+dfsg-1
Fix: upgrade to 4.1.8+dfsg-1
Debian:14 debian spip < 4.1.8+dfsg-1
Fix: upgrade to 4.1.8+dfsg-1
– spip spip < 3.2.18
>= 4.0.0, < 4.0.10
>= 4.1.0, < 4.1.8
4.2.0
cpe:2.3:a:spip:spip:*:*:*:*:*:*:*:*
– debian debian_linux 11.0
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
Original advisory text
SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1.
SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
>99% chance of attack within 30 days
Type
CWE-502Deserialization of Untrusted Data
Timeline
Published28 Feb 2023
Updated30 Sep 2026
First seen15 Sep 2026
Sources
DEBIAN-CVE-2023-27372 · OSV
CVE-2023-27372 · NVD
Track software like this
Free during beta