Vulnerability Description
SPIP before 4.4.5 and 4.3.9 allows an Open Redirect via the login form when used in AJAX mode. An attacker can craft a malicious URL that, when visited by a victim, redirects them to an arbitrary external site after login. This vulnerability only affects sites where the login page has been overridden to function in AJAX mode. It is not mitigated by the SPIP security screen.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Spip | Spip | >= 4.3.0, < 4.3.9 |
Related Weaknesses (CWE)
References
- https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-5.htmlBroken Link
- https://git.spip.net/spip/spipProduct
- https://www.vulncheck.com/advisories/spip-open-redirect-via-login-formThird Party Advisory
FAQ
What is CVE-2025-71244?
CVE-2025-71244 is a vulnerability with a CVSS score of 6.1 (MEDIUM). SPIP before 4.4.5 and 4.3.9 allows an Open Redirect via the login form when used in AJAX mode. An attacker can craft a malicious URL that, when visited by a victim, redirects them to an arbitrary exte...
How severe is CVE-2025-71244?
CVE-2025-71244 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-71244?
Check the references section above for vendor advisories and patch information. Affected products include: Spip Spip.