Information disclosure in SPIP - CVE-2019-16394
Published: September 29, 2019
Vulnerability identifier: #VU21413
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-16394
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to SPIP returns different responses for existing and non-existing email addresses in an error messages from the password-reminder page. A remote attacker can brute-force the password reminder functionality and exfiltrate email addresses of existing web application users.
Affected software
SPIP
spip (Debian package)
spip (Ubuntu package)
Ubuntu
spip (Debian package)
spip (Ubuntu package)
Ubuntu
How to mitigate CVE-2019-16394
Install updates from vendor's website.
SPIP - addressed in versions 3.1.11, 3.2.5
spip (Debian package) - addressed in versions 3.1.4-4~deb9u3, 3.2.4-1+deb10u1
spip (Ubuntu package) - update to 3.1.4-4~deb9u3build0.18.04.1
spip (Debian package) - addressed in versions 3.1.4-4~deb9u3, 3.2.4-1+deb10u1
spip (Ubuntu package) - update to 3.1.4-4~deb9u3build0.18.04.1
External References
- https://blog.spip.net/Mise-a-jour-CRITIQUE-de-securite-Sortie-de-SPIP-3-2-5-et-SPIP-3-1-11.html
- https://core.spip.net/issues/4171
- https://seclists.org/bugtraq/2019/Sep/40
- https://www.debian.org/security/2019/dsa-4532
- https://zone.spip.net/trac/spip-zone/changeset/117577/spip-zone
- https://zone.spip.net/trac/spip-zone/changeset/117578/spip-zone