#VU2746 Improper access control in SPIP - CVE-2009-3041

Vulnerability identifier: #VU2746

Vulnerability risk: Critical

CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red

CVE-ID: CVE-2009-3041

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Vulnerable software:
SPIP

Software vendor:
spip.net

The vulnerability allows a remote attacker to gain access to the target system.

The weakness exists due to improper access control related to installations and backups. A remote attacker can bypass implemented security control and compromise vulnerable website.

Successful exploitation of the vulnerability results in access to the vulnerable system.

Note: the vulnerability was being actively exploited.

Update to version 2.0.9 or later:
https://contrib.spip.net/SPIP-Security-Alert-new-version

• https://contrib.spip.net/