Vulnerability Description
SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1.
CVSS Score
9.8
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Spip | Spip | < 3.2.18 |
| Debian | Debian Linux | 11.0 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/171921/SPIP-Remote-Command-Execution.html
- http://packetstormsecurity.com/files/173044/SPIP-4.2.1-Remote-Code-Execution.htm
- https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-2-1-SPIPRelease Notes
- https://git.spip.net/spip/spip/commit/5aedf49b89415a4df3eb775eee3801a2b4b88266Patch
- https://git.spip.net/spip/spip/commit/96fbeb38711c6706e62457f2b732a652a04a409dPatch
- https://www.debian.org/security/2023/dsa-5367Third Party Advisory
- http://packetstormsecurity.com/files/171921/SPIP-Remote-Command-Execution.html
- http://packetstormsecurity.com/files/173044/SPIP-4.2.1-Remote-Code-Execution.htm
- https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-2-1-SPIPRelease Notes
- https://git.spip.net/spip/spip/commit/5aedf49b89415a4df3eb775eee3801a2b4b88266Patch
- https://git.spip.net/spip/spip/commit/96fbeb38711c6706e62457f2b732a652a04a409dPatch
- https://www.debian.org/security/2023/dsa-5367Third Party Advisory
- https://packetstorm.news/files/id/171921
- https://packetstorm.news/files/id/173044
FAQ
What is CVE-2023-27372?
CVE-2023-27372 is a vulnerability with a CVSS score of 9.8 (CRITICAL). SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1.
How severe is CVE-2023-27372?
CVE-2023-27372 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2023-27372?
Check the references section above for vendor advisories and patch information. Affected products include: Spip Spip, Debian Debian Linux.