CVE-2022-28959: XSS
First published: Thu May 19 2022(Updated: )
Multiple cross-site scripting (XSS) vulnerabilities in the component /spip.php of Spip Web Framework v3.1.13 and below allows attackers to execute arbitrary web scripts or HTML.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Spip Spip | <=3.1.13 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://blog.spip.net/Mise-a-jour-CRITIQUE-de-securite-SPIP-3-2-8-et-SPIP-3-1-13.html
- https://github.com/spip/SPIP/commit/0394b44774555ae8331b6e65e35065dfa0bb41e4
- https://github.com/spip/SPIP/commit/6c1650713fc948318852ace759aab8f1a84791cf
- https://thinkloveshare.com/en/hacking/rce_on_spip_and_root_me/
- https://www.root-me.org/fr/Informations/Faiblesses-decouvertes/
Frequently Asked Questions
What is the vulnerability ID for the Spip Web Framework XSS vulnerabilities?
The vulnerability ID for the Spip Web Framework XSS vulnerabilities is CVE-2022-28959.
What is the severity of CVE-2022-28959?
The severity of CVE-2022-28959 is medium.
How can these XSS vulnerabilities be exploited?
These XSS vulnerabilities can be exploited by attackers to execute arbitrary web scripts or HTML.
Which version of the Spip Web Framework is affected by CVE-2022-28959?
The version of the Spip Web Framework affected by CVE-2022-28959 is v3.1.13 and below.
Are there any fixes or patches available for CVE-2022-28959?
Yes, fixes or patches are available for CVE-2022-28959. It is recommended to update to Spip Web Framework version 3.2.8 or 3.1.13.
- collector/nvd-index
- agent/references
- agent/weakness
- agent/tags
- agent/type
- agent/event
- agent/severity
- agent/author
- agent/description
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- vendor/spip
- canonical/spip spip
- version/spip spip/3.1.13