CVE-2016-9997: XSS
SPIP 3.1.x suffers from a Reflected Cross Site Scripting Vulnerability in /ecrire/exec/pucestatut.php involving the $id parameter, as demonstrated by a /ecrire/?exec=pucestatut URL.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-9997?
CVE-2016-9997 is classified as a medium severity vulnerability due to its potential for reflected cross-site scripting attacks.
How do I fix CVE-2016-9997?
To fix CVE-2016-9997, update SPIP to version 3.1.4 or later, which addresses this reflected cross-site scripting vulnerability.
What versions of SPIP are affected by CVE-2016-9997?
CVE-2016-9997 affects SPIP versions 3.1.0, 3.1.1, 3.1.2, and 3.1.3, including their alpha, beta, and release candidate variants.
What is a reflected cross-site scripting vulnerability as seen in CVE-2016-9997?
A reflected cross-site scripting vulnerability, like in CVE-2016-9997, occurs when an attacker can inject malicious scripts into web pages that are then executed by users' browsers.
Can CVE-2016-9997 be exploited remotely?
Yes, CVE-2016-9997 can be exploited remotely if a user visits a specially crafted URL that leverages the vulnerability.