Freely subscribe to our NEWSLETTER

This bulletin was written by Vigil@nce : https://vigilance.fr/offer

SYNTHESIS OF THE VULNERABILITY

An attacker can use several vulnerabilities of SPIP.

Impacted products: Debian, SPIP.

Severity: 2/4.

Creation date: 03/10/2016.

Revision date: 06/10/2016.

DESCRIPTION OF THE VULNERABILITY

Several vulnerabilities were announced in SPIP.

An attacker can use a vulnerability via Template
Compiler/Composer, in order to run code. [severity:2/4;
CVE-2016-7998]

An attacker can trigger a Cross Site Request Forgery, in order to
force the victim to perform operations. [severity:2/4;
CVE-2016-7980]

An attacker can trigger a Cross Site Scripting, in order to run
JavaScript code in the context of the web site. [severity:2/4;
CVE-2016-7981]

An attacker can bypass security features via File Enumeration, in
order to obtain sensitive information. [severity:2/4;
CVE-2016-7982]

An attacker can bypass security features via a Server Side Request
Forgery, in order to obtain sensitive information. [severity:2/4;
CVE-2016-7999]

ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN

https://vigilance.fr/vulnerability/SPIP-five-vulnerabilities-20749