CVE-2021-44120

Name	CVE-2021-44120
Description	SPIP 4.0.0 is affected by a Cross Site Scripting (XSS) vulnerability in ecrire/public/interfaces.php, adding the function safehtml to the vulnerable fields. An editor is able to modify his personal information. If the editor has an article written and available, when a user goes to the public site and wants to read the author's information, the malicious code will be executed. The "Who are you" and "Website Name" fields are vulnerable.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-2867-1, DSA-5028-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
spip (PTS)	buster	3.2.4-1+deb10u9	fixed
	buster (security)	3.2.4-1+deb10u13	fixed
	bullseye	3.2.11-3+deb11u10	fixed
	bullseye (security)	3.2.11-3+deb11u7	fixed
	bookworm	4.1.9+dfsg-1+deb12u4	fixed
	sid, trixie	4.2.11+dfsg-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
spip	source	stretch	3.1.4-4~deb9u4+deb9u2	DLA-2867-1
spip	source	buster	3.2.4-1+deb10u5	DSA-5028-1
spip	source	bullseye	3.2.11-3+deb11u1	DSA-5028-1
spip	source	(unstable)	3.2.12-1

Notes

https://git.spip.net/spip/spip/commit/d548391d799387d1e93cf1a369d385c72f7d5c81
https://git.spip.net/spip/spip/commit/361cc26080d1377bc55d2cb80736e5cfaf5fd242 (v3.2.12)
https://blog.spip.net/SPIP-4-0-1_SPIP-3-1-12.html