PHP Object Injection Vulnerability in SPIP Web Publishing System
CVE-2016-3154

9.8CRITICAL

Key Information:

Vendor

Spip

Status
Spip
Vendor
CVE Published:
8 April 2016

What is CVE-2016-3154?

The encoder_contexte_ajax function in ecrire/inc/filtres.php within certain versions of the SPIP Web Publishing System is susceptible to PHP object injection vulnerabilities. This flaw allows attackers to manipulate serialized objects, potentially executing arbitrary PHP code remotely. Versions prior to 2.1.19, 3.0.22, and 3.1.1 have been identified as vulnerable, necessitating immediate updates to mitigate risks associated with this exploitation potential.

References

https://blog.spip.net/Mise-a-jour-CRITIQUE-de-securite-So...
x_refsource_CONFIRM
http://www.debian.org/security/2016/dsa-3518
vendor-advisoryx_refsource_DEBIAN
https://core.spip.net/projects/spip/repository/revisions/...
x_refsource_CONFIRM

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.