ecrire/public/assembler.php in SPIP before 4.1.13 and 4.2.x before 4.2.7 allows XSS because input from _request() is not restricted to safe characters such as alphanumerics.
References
Configurations
History
15 Mar 2024, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
19 Jan 2024, 05:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) ecrire/public/assembler.php in SPIP before 4.1.13 and 4.2.x before 4.2.7 allows XSS because input from _request() is not restricted to safe characters such as alphanumerics. |
10 Jan 2024, 16:42
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:spip:spip:*:*:*:*:*:*:*:* | |
| References | () https://blog.spip.net/Mise-a-jour-de-maintenance-et-securite-sortie-de-SPIP-4-2-7-SPIP-4-1-13.html?lang=fr - Release Notes | |
| References | () https://git.spip.net/spip/spip/commit/e90f5344b8c82711053053e778d38a35e42b7bcb - Patch | |
| CWE | CWE-79 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
| First Time |
Spip spip
Spip |
04 Jan 2024, 07:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-01-04 07:15
Updated : 2024-03-15 16:15
NVD link : CVE-2023-52322
Mitre link : CVE-2023-52322
CVE.ORG link : CVE-2023-52322
JSON object : View
Products Affected
spip
- spip
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')