Deserialization in Spip
CVE-2023-27372
SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1.
Vulnerability class: Insecure Deserialization
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.997 (100.0th percentile), scored .
Very high probability of exploitation in the next 30 days — among the top 0.1% most-likely-to-be-exploited CVEs. 100th percentile — 100.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
The 30-day trend appears once there are two daily scores.
Affected products
- Spip — versions 4.2.0
- Debian Linux — versions 11.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-2-1-SPIP-4-1-8-… (Release Notes)
- git.spip.net/spip/spip/commit/5aedf49b89415a4df3eb775eee3801a2b4b88266 (Patch)
- git.spip.net/spip/spip/commit/96fbeb38711c6706e62457f2b732a652a04a409d (Patch)
- www.debian.org/security/2023/dsa-5367 (vendor-advisory, Third Party Advisory)
- packetstormsecurity.com/files/171921/SPIP-Remote-Command-Execution.html
- packetstormsecurity.com/files/173044/SPIP-4.2.1-Remote-Code-Execution.html
- 134c704f-9b21-4f2e-91b3-4a467353bcc0
- 134c704f-9b21-4f2e-91b3-4a467353bcc0
Frequently asked questions
- What is CVE-2023-27372?
- CVE-2023-27372 is a critical-severity vulnerability in Spip, classified under Deserialization of Untrusted Data. CVSS score: 9.8/10. Published 2023-02-28.
- How severe is CVE-2023-27372?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2023-27372 known to be exploited?
- 40 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.