8.8

CVE-2019-11071

SPIP 3.1 before 3.1.10 and 3.2 before 3.2.4 allows authenticated visitors to execute arbitrary code on the host server because var_memotri is mishandled.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Spip ≫ Spip Version >= 3.1.0 < 3.1.10
Spip ≫ Spip Version >= 3.2.0 < 3.2.4
Debian ≫ Debian Linux Version9.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.58% 0.832
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.8 2.8 5.9
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 6.5 8 6.4
AV:N/AC:L/Au:S/C:P/I:P/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://usn.ubuntu.com/4536-1/
https://blog.spip.net/Mise-a-jour-CRITIQUE-de-securite-Sortie-de-SPIP-3-1-10-et-SPIP-3-2-4.html
Patch
Vendor Advisory
https://github.com/spip/SPIP/commit/3ef87c525bc0768c926646f999a54222b37b5d36
Patch
Third Party Advisory
https://github.com/spip/SPIP/commit/824d17f424bf77d17af89c18c3dc807a3199567e
Patch
Third Party Advisory
https://github.com/spip/SPIP/compare/1e3872c...9861a47
Third Party Advisory
https://www.debian.org/security/2019/dsa-4429
Third Party Advisory