CVE-2021-44120

SPIP 4.0.0 is affected by a Cross Site Scripting (XSS) vulnerability in ecrire/public/interfaces.php, adding the function safehtml to the vulnerable fields

published January 26, 2022

CVSS
—
EPSS
1%
Percentile
51.6
In the wild
Unconfirmed
What it is

SPIP 4.0.0 is affected by a Cross Site Scripting (XSS) vulnerability in ecrire/public/interfaces.php, adding the function safehtml to the vulnerable fields. An editor is able to modify his personal information. If the editor has an article written and available, when a user goes to the public site and wants to read the author's information, the malicious code will be executed. The "Who are you" and "Website Name" fields are vulnerable.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00674 · 51.6th percentile
Published
2022-01-26T11:26Z
EPSS history
Timeline
  • 26 JAN 11:26Z
    SPIP 4.0.0 is affected by a Cross Site Scripting (XSS) vulnerability in ecrire/public/interfaces.php, adding the function safehtml to the vulnerable fields
    cvelistv5