Vulnerability · Published Jan 26, 2022 · Assigned by mitre
CVE-2021-44120
Medium 5.4
In plain English
A medium-severity security flaw in the spip package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
SPIP 4.0.0 is affected by a Cross Site Scripting (XSS) vulnerability in ecrire/public/interfaces.php, adding the function safehtml to the vulnerable fields. An editor is able to modify his personal information. If the editor has an article written and available, when a user goes to the public site and wants to read the author's information, the malicious code will be executed. The "Who are you" and "Website Name" fields are vulnerable.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | spip | 3.2.12-1 | DEBIAN-CVE-2021-44120 |
| Debian:14 | spip | 3.2.12-1 | DEBIAN-CVE-2021-44120 |