CVE-2025-71244
CVE-2025-71244 · SPIP < 4.4.5 Open Redirect via Login Form
This page contains facts from public vulnerability sources. Check the original advisory before updating.
SPIP before 4.4.5 and 4.3.9 allows an Open Redirect via the login form when used in AJAX mode. An attacker can craft a malicious URL that, when visited by a victim, redirects them to an arbitrary external site after login. This vulnerability only affects sites where the login page has been overridden to function in AJAX mode. It is not mitigated by the SPIP security screen.
CVSS 5.1 · Medium · EPSS 0.2% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
spip
- Versions
- ≥ 4.3.0, < 4.3.9: Affected (semver)
- ≥ 4.4.0, < 4.4.5: Affected (semver)
Update to 4.3.9; Update to 4.4.5
spip Debian:13
- Versions
- 4.4.3+dfsg-1
- 4.4.3+dfsg-1+deb13u1
- 4.4.4+dfsg-1
- Affected ranges
- ECOSYSTEM: < 4.4.5+dfsg-1
Update to 4.4.5+dfsg-1
spip Debian:14
- Versions
- 4.4.3+dfsg-1
- 4.4.4+dfsg-1
- Affected ranges
- ECOSYSTEM: < 4.4.5+dfsg-1
Update to 4.4.5+dfsg-1
spip Ubuntu:Pro:16.04:LTS
- Versions
- 3.0.20-1
- 3.0.21-1
- 3.0.21-1ubuntu1
- 3.0.21-1ubuntu1+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
spip Ubuntu:Pro:18.04:LTS
- Versions
- 3.1.4-3
- 3.1.4-4~deb9u3build0.18.04.1
- 3.1.4-4~deb9u5build0.18.04.1
- 3.1.4-4~deb9u5ubuntu0.1~esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
spip Ubuntu:Pro:20.04:LTS
- Versions
- 3.2.4-1
- 3.2.5-1
- 3.2.7-1
- 3.2.7-1ubuntu0.1
- 3.2.7-1ubuntu0.1+esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
spip Ubuntu:22.04:LTS
- Versions
- 3.2.11-3
- 3.2.12-1
- 4.0.2-1
- 4.0.4-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
spip Ubuntu:24.04:LTS
- Versions
- 4.1.11+dfsg-1
- 4.1.12+dfsg-1
- 4.1.13+dfsg-1
- 4.1.15+dfsg-1
- 4.2.9+dfsg-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
spip Ubuntu:25.10
- Versions
- 4.3.8+dfsg-1
- 4.4.3+dfsg-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published