Cross Site Scripting Vulnerability in SPIP by SPIP Team
CVE-2021-44120

5.4MEDIUM

Key Information:

Vendor

Spip

Status
Spip
Vendor
CVE Published:
26 January 2022

What is CVE-2021-44120?

SPIP version 4.0.0 contains a Cross Site Scripting vulnerability located in ecrire/public/interfaces.php. This flaw enables an editor to alter personal details, which can be exploited when a user accesses the public site to view the author's information. Specifically, the fields 'Who are you' and 'Website Name' are affected, leading to potential execution of malicious scripts.

References

https://git.spip.net/spip/spip/commit/d548391d799387d1e93...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.