CVE-2024-7954

EUVD-2024-48791
The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthenticated attacker can execute arbitrary PHP as the SPIP user by sending a crafted HTTP request.
Eval Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 99%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
spipspip
4.3.0-alpha ≤
𝑥
< 4.3.0-alpha2
ADP
spipspip
4.2.0 ≤
𝑥
< 4.2.13
ADP
spipspip
4.1.0 ≤
𝑥
< 4.1.16
ADP
Debian logo
Debian Releases
Debian Product
Codename
spip
bullseye
3.2.11-3+deb11u10
not-affected
bullseye (security)
3.2.11-3+deb11u7
fixed
forky
4.4.7+dfsg-1
fixed
sid
4.4.7+dfsg-1
fixed
trixie
4.4.3+dfsg-1+deb13u1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
spip
bionic
needed
focal
needed
jammy
needed
noble
needed
oracular
not-affected
plucky
not-affected
questing
not-affected
xenial
needed
Common Weakness Enumeration
References
https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-3-0-alpha2-SPIP-4-2-13-SPIP-4.html
https://thinkloveshare.com/hacking/spip_preauth_rce_2024_part_1_the_feather/
https://vulncheck.com/advisories/spip-porte-plume