Input validation error in SPIP - CVE-2019-19830
Published: December 17, 2019 / Updated: July 17, 2020
Vulnerability identifier: #VU30548
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2019-19830
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: spip.net
Affected software:
SPIP
SPIP
Detailed vulnerability description
The vulnerability allows a remote authenticated user to manipulate data.
_core_/plugins/medias in SPIP 3.2.x before 3.2.7 allows remote authenticated authors to inject content into the database.
How to mitigate CVE-2019-19830
Install update from vendor's website.
Sources
- https://blog.spip.net/Mise-a-jour-CRITIQUE-de-securite-sortie-de-SPIP-3-2-7-SPIP-3-1-12.html
- https://git.spip.net/SPIP/spip/commit/8eb11ba132b92696eb34d606d71aa8edf40e0f69
- https://www.debian.org/security/2019/dsa-4583
- https://zone.spip.net/trac/spip-zone/changeset/118898/spip-zone/_core_/plugins/medias