Input validation error in SPIP - CVE-2019-19830
Published: December 17, 2019 / Updated: July 17, 2020
Vulnerability identifier: #VU30548
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-19830
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated user to manipulate data.
_core_/plugins/medias in SPIP 3.2.x before 3.2.7 allows remote authenticated authors to inject content into the database.
Affected software
SPIP
Ubuntu
spip (Ubuntu package)
Ubuntu
spip (Ubuntu package)
How to mitigate CVE-2019-19830
Install update from vendor's website.
SPIP - update to 3.2.7
spip (Ubuntu package) - update to 3.1.4-4~deb9u3build0.18.04.1
spip (Ubuntu package) - update to 3.1.4-4~deb9u3build0.18.04.1
External References
- https://blog.spip.net/Mise-a-jour-CRITIQUE-de-securite-sortie-de-SPIP-3-2-7-SPIP-3-1-12.html
- https://git.spip.net/SPIP/spip/commit/8eb11ba132b92696eb34d606d71aa8edf40e0f69
- https://www.debian.org/security/2019/dsa-4583
- https://zone.spip.net/trac/spip-zone/changeset/118898/spip-zone/_core_/plugins/medias