p PatchFirst

CVE-2024-8517

CVE-2024-8517 · SPIP Bigup Multipart File Upload OS Command Injection

This page contains facts from public vulnerability sources. Check the original advisory before updating.

SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. A remote and unauthenticated attacker can execute arbitrary operating system commands by sending a crafted multipart file upload HTTP request.

CVSS 9.8 · Critical · EPSS 94.6% · Public exploit · Fix available

Published
Updated

Stack: system

Affected products and versions

  • spip

    Versions
    • ≥ 4.3.0, ≤ 4.3.1: Affected (semver)
    • ≥ 4.2.0, ≤ 4.2.15: Affected (semver)
    • ≥ 4.1.0, < 4.1.18: Affected (semver)

    Update to 4.1.18

  • spip Debian:13

    Affected ranges
    • ECOSYSTEM: < 4.3.2+dfsg-1

    Update to 4.3.2+dfsg-1

  • spip Debian:14

    Affected ranges
    • ECOSYSTEM: < 4.3.2+dfsg-1

    Update to 4.3.2+dfsg-1

  • spip Ubuntu:Pro:16.04:LTS

    Versions
    • 3.0.20-1
    • 3.0.21-1
    • 3.0.21-1ubuntu1
    • 3.0.21-1ubuntu1+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • spip Ubuntu:Pro:18.04:LTS

    Versions
    • 3.1.4-3
    • 3.1.4-4~deb9u3build0.18.04.1
    • 3.1.4-4~deb9u5build0.18.04.1
    Affected ranges
    • ECOSYSTEM: < 3.1.4-4~deb9u5ubuntu0.1~esm2

    Update to 3.1.4-4~deb9u5ubuntu0.1~esm2

  • spip Ubuntu:Pro:20.04:LTS

    Versions
    • 3.2.4-1
    • 3.2.5-1
    • 3.2.7-1
    • 3.2.7-1ubuntu0.1
    Affected ranges
    • ECOSYSTEM: < 3.2.7-1ubuntu0.1+esm2

    Update to 3.2.7-1ubuntu0.1+esm2

  • spip Ubuntu:22.04:LTS

    Versions
    • 3.2.11-3
    • 3.2.12-1
    • 4.0.2-1
    • 4.0.4-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • spip Ubuntu:24.04:LTS

    Versions
    • 4.1.11+dfsg-1
    • 4.1.12+dfsg-1
    • 4.1.13+dfsg-1
    • 4.1.15+dfsg-1
    • 4.2.9+dfsg-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →