CVE-2019-16391

Published: 17 September 2019

SPIP before 3.1.11 and 3.2 before 3.2.5 allows authenticated visitors to modify any published content and execute other modifications in the database. This is related to ecrire/inc/meta.php and ecrire/inc/securiser_action.php.

Priority

Medium

CVSS 3 base score: 6.5

Status

Package Release Status
spip
Launchpad, Ubuntu, Debian 		Upstream
Released (3.2.5-1)
Ubuntu 20.10 (Groovy Gorilla) Not vulnerable
(3.2.5-1)
Ubuntu 20.04 LTS (Focal Fossa) Not vulnerable
(3.2.5-1)
Ubuntu 18.04 LTS (Bionic Beaver)
Released (3.1.4-4~deb9u3build0.18.04.1)
Ubuntu 16.04 LTS (Xenial Xerus) Needed

Ubuntu 14.04 ESM (Trusty Tahr) Does not exist

Patches:
Upstream: https://git.spip.net/SPIP/spip/commit/187952ce85e73b52c2753f2d54fc2c44807b8f79
Upstream: https://git.spip.net/SPIP/spip/commit/3cbc758400323ab006c00ea78eacdb8f76aa5f66

References

Join the discussion

Canonical is offering Extended Security Maintenance

Canonical is offering Ubuntu 14.04 Extended Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM

Further reading