high8.8
CVE-2022-26846
SPIP before 3.2.14 and 4.x before 4.0.5 allows remote authenticated editors to execute arbitrary code.
Impact
SPIP before 3.2.14 and 4.x before 4.0.5 allows remote authenticated editors to execute arbitrary code.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Spip | Spip | before 3.2.14 from 4.0.0 before 4.0.5 |
| Debian | Debian Linux | Versions 9.0, 10.0, 11.0 |
References
- NVD record
- CVE.org record
- https://blog.spip.net/Mise-a-jour-critique-de-securite-sorties-de-SPIP-4-0-5-et-SPIP-3-2-14.html
- https://git.spip.net/spip/medias/commit/3014b845da2dd8ad15ff04b50fd9dbba388a9ca2
- https://lists.debian.org/debian-lts-announce/2022/03/msg00020.html
- https://lists.debian.org/debian-security-announce/2022/msg00060.html
- https://blog.spip.net/Mise-a-jour-critique-de-securite-sorties-de-SPIP-4-0-5-et-SPIP-3-2-14.html
- https://git.spip.net/spip/medias/commit/3014b845da2dd8ad15ff04b50fd9dbba388a9ca2
- https://lists.debian.org/debian-lts-announce/2022/03/msg00020.html
- https://lists.debian.org/debian-security-announce/2022/msg00060.html