Vulnerability identifier: #VU72753

Vulnerability risk: High

CVSSv3.1: 9.1 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C]

CVE-ID: CVE-2023-27372

CWE-ID: CWE-502

Exploitation vector: Network

Exploits in database: 3

• June 26, 2023
  • CVE-2023-27372 (SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1.) [Github]
  • CVE-2023-27372 (SPIP Vulnerability Scanner - CVE-2023-27372 Detector) [Github]
• April 17, 2023
  • SPIP form PHP Injection [Metasploit]

Impact: Code execution

Vulnerable software:
SPIP
Web applications / CMS

Vendor: spip.net