CVE-2019-19830

_core_/plugins/medias in SPIP 3.2.x before 3.2.7 allows remote authenticated authors to inject content into the database.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 61%
VendorProductVersion
spipspip
3.2.0 ≤
𝑥
< 3.2.7
debiandebian_linux
9.0
debiandebian_linux
10.0
canonicalubuntu_linux
18.04
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
spip
bullseye
3.2.11-3+deb11u10
fixed
stretch
not-affected
jessie
not-affected
bullseye (security)
3.2.11-3+deb11u7
fixed
sid
4.3.3+dfsg-1
fixed
trixie
4.3.3+dfsg-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
spip
focal
not-affected
eoan
ignored
disco
ignored
bionic
Fixed 3.1.4-4~deb9u3build0.18.04.1
released
xenial
not-affected
trusty
dne
References
https://blog.spip.net/Mise-a-jour-CRITIQUE-de-securite-sortie-de-SPIP-3-2-7-SPIP-3-1-12.html
https://git.spip.net/SPIP/spip/commit/8eb11ba132b92696eb34d606d71aa8edf40e0f69
https://usn.ubuntu.com/4536-1/
https://www.debian.org/security/2019/dsa-4583
https://zone.spip.net/trac/spip-zone/changeset/118898/spip-zone/_core_/plugins/medias
https://blog.spip.net/Mise-a-jour-CRITIQUE-de-securite-sortie-de-SPIP-3-2-7-SPIP-3-1-12.html
https://git.spip.net/SPIP/spip/commit/8eb11ba132b92696eb34d606d71aa8edf40e0f69
https://usn.ubuntu.com/4536-1/
https://www.debian.org/security/2019/dsa-4583
https://zone.spip.net/trac/spip-zone/changeset/118898/spip-zone/_core_/plugins/medias