CVE-2021-44123

NameCVE-2021-44123
DescriptionSPIP 4.0.0 is affected by a remote command execution vulnerability. To exploit the vulnerability, an attacker must craft a malicious picture with a double extension, upload it and then click on it to execute it.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
ReferencesDLA-2867-1, DSA-5028-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
spip (PTS)buster, buster (security)3.2.4-1+deb10u9fixed
bullseye (security), bullseye3.2.11-3+deb11u5fixed
bookworm, sid4.1.5+dfsg-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
spipsourcestretch3.1.4-4~deb9u4+deb9u2DLA-2867-1
spipsourcebuster3.2.4-1+deb10u5DSA-5028-1
spipsourcebullseye3.2.11-3+deb11u1DSA-5028-1
spipsource(unstable)3.2.12-1

Notes

https://git.spip.net/spip/spip/commit/1cf91def15966406ddd0488cf9d1ecd1ae82d47a (master)
https://git.spip.net/spip/spip/commit/97e2888e9c92ad4bd68e8f80079583249714fbfa (v4.0.1)
https://blog.spip.net/SPIP-4-0-1_SPIP-3-1-12.html

Search for package or bug name: Reporting problems