USN-5482-1

Dashboard / Vulnerabilities / USN-5482-1

USN-5482-1

Summary: spip vulnerabilities

Details: It was discovered that SPIP incorrectly validated inputs. An authenticated attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2020-28984) Charles Fol and Théo Gordyjan discovered that SPIP is vulnerable to Cross Site Scripting (XSS). If a user were tricked into browsing a malicious SVG file, an attacker could possibly exploit this issue to execute arbitrary code. This issue was only fixed in Ubuntu 21.10. (CVE-2021-44118, CVE-2021-44120, CVE-2021-44122, CVE-2021-44123) It was discovered that SPIP incorrectly handled certain forms. A remote authenticated editor could possibly use this issue to execute arbitrary code, and a remote unauthenticated attacker could possibly use this issue to obtain sensitive information. (CVE-2022-26846, CVE-2022-26847)

References: https://ubuntu.com/security/notices/USN-5482-1, https://ubuntu.com/security/CVE-2020-28984, https://ubuntu.com/security/CVE-2021-44118, https://ubuntu.com/security/CVE-2021-44120, https://ubuntu.com/security/CVE-2021-44122, https://ubuntu.com/security/CVE-2021-44123, https://ubuntu.com/security/CVE-2022-26846, https://ubuntu.com/security/CVE-2022-26847