Lucene search

GoogleOSV:CVE-2024-23659

HistoryJan 19, 2024 - 5:15 a.m.

CVE-2024-23659

2024-01-1905:15:09

Google

osv.dev

spip

file upload

xss

javascript

bigup.js

5.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

20.3%

JSON

SPIP before 4.1.14 and 4.2.x before 4.2.8 allows XSS via the name of an uploaded file. This is related to javascript/bigup.js and javascript/bigup.utils.js.

CPENameOperatorVersion
spipeq4.2.4
spipeq4.2.7
spipeq4.2.1
spipeq4.2.0
spipeq4.2.5
spipeq4.2.3
spipeq4.2.9
spipeq4.2.6
spipeq4.2.2
spipeq4.2.8

Name	Operator	Version
spip	eq	4.2.4
spip	eq	4.2.7
spip	eq	4.2.1
spip	eq	4.2.0
spip	eq	4.2.5
spip	eq	4.2.3
spip	eq	4.2.9
spip	eq	4.2.6
spip	eq	4.2.2
spip	eq	4.2.8

References

blog.spip.net/Mise-a-jour-de-maintenance-et-securite-sortie-de-SPIP-4-2-8-SPIP-4-1-14.html?lang=fr

git.spip.net/spip/bigup/commit/0757f015717cb72b84dba0e9a375ec71caddf1c2

git.spip.net/spip/bigup/commit/ada821c076d67d1147a195178223d0b4a6d8cecc