CVE-2022-26847

2022-03-1017:48:02

Debian Security Bug Tracker

security-tracker.debian.org

spip

unauthenticated access

editorial objects

cve-2022-26847

unix

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.002

Percentile

53.9%

JSON

SPIP before 3.2.14 and 4.x before 4.0.5 allows unauthenticated access to information about editorial objects.

OSVersionArchitecturePackageVersionFilename
Debian11allspip< 3.2.11-3+deb11u3spip_3.2.11-3+deb11u3_all.deb
Debian999allspip< 4.0.5-1spip_4.0.5-1_all.deb
Debian13allspip< 4.0.5-1spip_4.0.5-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	11	all	spip	< 3.2.11-3+deb11u3	spip_3.2.11-3+deb11u3_all.deb
Debian	999	all	spip	< 4.0.5-1	spip_4.0.5-1_all.deb
Debian	13	all	spip	< 4.0.5-1	spip_4.0.5-1_all.deb