CVE-2019-19830

EUVD-2019-9428
_core_/plugins/medias in SPIP 3.2.x before 3.2.7 allows remote authenticated authors to inject content into the database.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 68%
Affected Products (NVD)
VendorProductVersion
spipspip
3.2.0 ≤
𝑥
< 3.2.7
debiandebian_linux
9.0
debiandebian_linux
10.0
canonicalubuntu_linux
18.04
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
spip
bullseye
3.2.11-3+deb11u10
fixed
bullseye (security)
3.2.11-3+deb11u7
fixed
jessie
not-affected
sid
4.3.3+dfsg-1
fixed
stretch
not-affected
trixie
4.3.3+dfsg-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
spip
bionic
Fixed 3.1.4-4~deb9u3build0.18.04.1
released
disco
ignored
eoan
ignored
focal
not-affected
trusty
dne
xenial
not-affected
References
https://blog.spip.net/Mise-a-jour-CRITIQUE-de-securite-sortie-de-SPIP-3-2-7-SPIP-3-1-12.html
https://git.spip.net/SPIP/spip/commit/8eb11ba132b92696eb34d606d71aa8edf40e0f69
https://usn.ubuntu.com/4536-1/
https://www.debian.org/security/2019/dsa-4583
https://zone.spip.net/trac/spip-zone/changeset/118898/spip-zone/_core_/plugins/medias
https://blog.spip.net/Mise-a-jour-CRITIQUE-de-securite-sortie-de-SPIP-3-2-7-SPIP-3-1-12.html
https://git.spip.net/SPIP/spip/commit/8eb11ba132b92696eb34d606d71aa8edf40e0f69
https://usn.ubuntu.com/4536-1/
https://www.debian.org/security/2019/dsa-4583
https://zone.spip.net/trac/spip-zone/changeset/118898/spip-zone/_core_/plugins/medias