Ubuntu.comUB:CVE-2021-44118CVE-2021-44118
3.5 Low
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:S/C:N/I:P/A:N
5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
0.001 Low
EPSS
Percentile
25.8%
SPIP 4.0.0 is affected by a Cross Site Scripting (XSS) vulnerability. To
exploit the vulnerability, a visitor must browse to a malicious SVG file.
The vulnerability allows an authenticated attacker to inject malicious code
running on the client side into web pages visited by other users (stored
XSS).
References
git.spip.net/spip/medias/commit/13c293fabd35e2c152379522c29432423936cbba
git.spip.net/spip/spip/commit/1cf91def15966406ddd0488cf9d1ecd1ae82d47a
git.spip.net/spip/spip/commit/4ccf90a6912d7fab97e1bd5619770c9236cc7357
launchpad.net/bugs/cve/CVE-2021-44118
nvd.nist.gov/vuln/detail/CVE-2021-44118
security-tracker.debian.org/tracker/CVE-2021-44118
ubuntu.com/security/notices/USN-5482-1
ubuntu.com/security/notices/USN-5482-2
www.cve.org/CVERecord?id=CVE-2021-44118
Related
3.5 Low
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:S/C:N/I:P/A:N
5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
0.001 Low
EPSS
Percentile
25.8%