{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SPIP versions 4.4.x ant\u00e9rieures \u00e0 4.4.5",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    },
    {
      "description": "SPIP versions 4.3.x ant\u00e9rieures \u00e0 4.3.9",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [],
  "initial_release_date": "2025-09-08T00:00:00",
  "last_revision_date": "2025-09-08T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0762",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-09-08T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans SPIP. Elle permet \u00e0 un attaquant de provoquer un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Vuln\u00e9rabilit\u00e9 dans SPIP",
  "vendor_advisories": [
    {
      "published_at": "2025-09-08",
      "title": "Bulletin de s\u00e9curit\u00e9 SPIP",
      "url": "https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-5-SPIP-4-3-9.html"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Greffon \"Saisies pour formulaire\" versions ant\u00e9rieures \u00e0 5.11.1 pour SPIP",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [],
  "initial_release_date": "2025-02-12T00:00:00",
  "last_revision_date": "2025-02-12T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0124",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-02-12T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans le greffon \"Saisies pour formulaire\" pour SPIP. Elle permet \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance.",
  "title": "Vuln\u00e9rabilit\u00e9 dans le greffon \"Saisies pour formulaire\" pour SPIP",
  "vendor_advisories": [
    {
      "published_at": "2025-02-12",
      "title": "Bulletin de s\u00e9curit\u00e9 SPIP",
      "url": "https://blog.spip.net/Mise-a-jour-critique-de-securite-pour-le-plugin-Saisies.html"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SPIP versions 4.1.x ant\u00e9rieures \u00e0 4.1.20",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    },
    {
      "description": "SPIP versions 4.2.x ant\u00e9rieures \u00e0 4.2.17",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    },
    {
      "description": "SPIP versions 4.3.x ant\u00e9rieures \u00e0 4.3.6",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [],
  "initial_release_date": "2025-01-17T00:00:00",
  "last_revision_date": "2025-07-09T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0043",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-01-17T00:00:00.000000"
    },
    {
      "description": "Ajout de l\u0027identifiant CVE-2024-53619.",
      "revision_date": "2025-07-08T00:00:00.000000"
    },
    {
      "description": "Retrait de l\u0027identifiant CVE-2024-53619.",
      "revision_date": "2025-07-09T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans SPIP. Elle permet \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une injection de code indirecte \u00e0 distance (XSS).",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans SPIP",
  "vendor_advisories": [
    {
      "published_at": "2025-01-16",
      "title": "Bulletin de s\u00e9curit\u00e9 SPIP",
      "url": "https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-3-6-SPIP-4-2-17-SPIP-4-1-20.html"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SPIP versions 4.2.x ant\u00e9rieures \u00e0 4.2.16",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    },
    {
      "description": "SPIP versions ant\u00e9rieures \u00e0 4.1.18",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    },
    {
      "description": "SPIP versions 4.3.x ant\u00e9rieures \u00e0 4.3.2",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-8517",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-8517"
    }
  ],
  "initial_release_date": "2024-08-21T00:00:00",
  "last_revision_date": "2024-09-16T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-0702",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-08-21T00:00:00.000000"
    },
    {
      "description": "Ajout de l\u0027identifiant CVE.",
      "revision_date": "2024-09-16T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans SPIP. Elle permet \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance.",
  "title": "Vuln\u00e9rabilit\u00e9 dans SPIP",
  "vendor_advisories": [
    {
      "published_at": "2024-08-20",
      "title": "Bulletin de s\u00e9curit\u00e9 SPIP",
      "url": "https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-3-2-SPIP-4-2-16-SPIP-4-1-18.html"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SPIP versions ant\u00e9rieures \u00e0 4.2.15",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [],
  "initial_release_date": "2024-07-26T00:00:00",
  "last_revision_date": "2024-07-26T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-0629",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-07-26T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans SPIP. Elle permet \u00e0 un attaquant de provoquer une injection de code indirecte \u00e0 distance (XSS).",
  "title": "Vuln\u00e9rabilit\u00e9 dans SPIP",
  "vendor_advisories": [
    {
      "published_at": "2024-07-26",
      "title": "Bulletin de s\u00e9curit\u00e9 SPIP",
      "url": "https://blog.spip.net/Mise-a-jour-de-maintenance-et-securite-sortie-de-SPIP-4-2-15.html"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SPIP versions 4.3.x ant\u00e9rieures \u00e0 4.3.0-alpha2",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    },
    {
      "description": "SPIP versions 4.2.x ant\u00e9rieures \u00e0 4.2.13",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    },
    {
      "description": "SPIP versions ant\u00e9rieures \u00e0 4.1.16",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [],
  "initial_release_date": "2024-05-29T00:00:00",
  "last_revision_date": "2024-05-29T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-0447",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-05-29T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans SPIP. Elle permet \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance.",
  "title": "Vuln\u00e9rabilit\u00e9 dans SPIP",
  "vendor_advisories": [
    {
      "published_at": "2024-05-29",
      "title": "Bulletin de s\u00e9curit\u00e9 SPIP",
      "url": "https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-3-0-alpha2-SPIP-4-2-13-SPIP-4.html"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SPIP versions 4.1.x ant\u00e9rieures \u00e0 4.1.14",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    },
    {
      "description": "SPIP versions 4.2.x ant\u00e9rieures \u00e0 4.2.8",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2024-23659",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-23659"
    }
  ],
  "initial_release_date": "2024-01-12T00:00:00",
  "last_revision_date": "2024-01-12T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-0028",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-01-12T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans SPIP. Elle permet \u00e0 un attaquant\nde provoquer une injection de code indirecte \u00e0 distance (XSS).\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans SPIP",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 SPIP du 11 janvier 2024",
      "url": "https://blog.spip.net/Mise-a-jour-de-maintenance-et-securite-sortie-de-SPIP-4-2-8-SPIP-4-1-14.html"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SPIP versions 4.2.x ant\u00e9rieures \u00e0 4.2.7",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    },
    {
      "description": "SPIP versions 4.1.x ant\u00e9rieures \u00e0 4.1.13",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [],
  "initial_release_date": "2024-01-11T00:00:00",
  "last_revision_date": "2024-01-11T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-0025",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-01-11T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans SPIP. Elle permet \u00e0 un attaquant\nde provoquer une injection de code indirecte \u00e0 distance (XSS).\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans SPIP",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 SPIP du 18 d\u00e9cembre 2023",
      "url": "https://blog.spip.net/Mise-a-jour-de-maintenance-et-securite-sortie-de-SPIP-4-2-7-SPIP-4-1-13.html?lang=fr"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SPIP versions 4.2.x ant\u00e9rieures \u00e0 4.2.7",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    },
    {
      "description": "SPIP versions 4.1.x ant\u00e9rieures \u00e0 4.1.13",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [],
  "initial_release_date": "2023-12-19T00:00:00",
  "last_revision_date": "2023-12-19T00:00:00",
  "links": [],
  "reference": "CERTFR-2023-AVI-1045",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-12-19T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans \u003cspan\nclass=\"textit\"\u003eSPIP\u003c/span\u003e. Elle permet \u00e0 un attaquant de provoquer une\ninjection de code indirecte \u00e0 distance (XSS) et un probl\u00e8me de s\u00e9curit\u00e9\nnon sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans SPIP",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 SPIP du 18 d\u00e9cembre 2023",
      "url": "https://blog.spip.net/Mise-a-jour-de-maintenance-et-securite-sortie-de-SPIP-4-2-7-SPIP-4-1-13.html"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SPIP versions 4.2.x ant\u00e9rieures \u00e0 4.2.3",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    },
    {
      "description": "SPIP versions 4.1.x ant\u00e9rieures \u00e0 4.1.10",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [],
  "initial_release_date": "2023-06-08T00:00:00",
  "last_revision_date": "2023-06-08T00:00:00",
  "links": [],
  "reference": "CERTFR-2023-AVI-0442",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-06-08T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans SPIP. Elle permet \u00e0 un attaquant\nde provoquer un contournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans SPIP",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 SPIP SPIP-4-2-3-SPIP-4-1-10 du 07 juin 2023",
      "url": "https://blog.spip.net/Mise-a-jour-de-maintenance-et-securite-sortie-de-SPIP-4-2-3-SPIP-4-1-10.html"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SPIP versions 4.0.x ant\u00e9rieures \u00e0 4.0.10",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    },
    {
      "description": "SPIP versions 4.2.x ant\u00e9rieures \u00e0 4.2.1",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    },
    {
      "description": "SPIP versions 4.1.x ant\u00e9rieures \u00e0 4.1.8",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    },
    {
      "description": "SPIP versions ant\u00e9rieures \u00e0 3.2.18",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [],
  "initial_release_date": "2023-06-01T00:00:00",
  "last_revision_date": "2023-06-01T00:00:00",
  "links": [],
  "reference": "CERTFR-2023-AVI-0426",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-06-01T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans SPIP. Elle permet \u00e0 un attaquant\nde provoquer une ex\u00e9cution de code arbitraire \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans SPIP",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 SPIP 1-5-2-1-5-3 du 31 mai 2023",
      "url": "https://blog.spip.net/Mise-a-jour-critique-de-l-ecran-de-securite-1-5-2-1-5-3?lang=fr"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SPIP versions 3.1.x versions ant\u00e9rieures \u00e0 3.1.4",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    },
    {
      "description": "SPIP versions 3.0.x versions ant\u00e9rieures \u00e0 3.0.25",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    },
    {
      "description": "SPIP versions ant\u00e9rieures \u00e0 2.1.30",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [],
  "initial_release_date": "2017-03-09T00:00:00",
  "last_revision_date": "2017-03-09T00:00:00",
  "links": [],
  "reference": "CERTFR-2017-AVI-072",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2017-03-09T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 corrig\u00e9 dans \u003cspan class=\"textit\"\u003eSPIP\u003c/span\u003e.\nElle permet \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire\n\u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans SPIP",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 SPIP du 06 mars 2017",
      "url": "https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-3-1-4-SPIP-3-0-25-et-SPIP-2-1-30.html?lang=fr"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SPIP versions 3.0.x ant\u00e9rieures \u00e0 3.0.22",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    },
    {
      "description": "SPIP versions 2.1.x ant\u00e9rieures \u00e0 2.1.29",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    },
    {
      "description": "SPIP versions 3.1.x ant\u00e9rieures \u00e0 3.1.1",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [],
  "initial_release_date": "2016-03-11T00:00:00",
  "last_revision_date": "2016-03-11T00:00:00",
  "links": [],
  "reference": "CERTFR-2016-AVI-096",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2016-03-11T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eSPIP\u003c/span\u003e. Elles permettent \u00e0 un attaquant de provoquer\nune ex\u00e9cution de code arbitraire \u00e0 distance.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans SPIP",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 SPIP du 10 mars 2016",
      "url": "https://blog.spip.net/Mise-a-jour-CRITIQUE-de-securite-Sortie-de-SPIP-3-1-1-SPIP-3-0-22-et-SPIP-2-1.html"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "versions ant\u00e9rieures \u00e0 2.1.24",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    },
    {
      "description": "Versions ant\u00e9rieures \u00e0 3.0.13",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [],
  "initial_release_date": "2013-11-12T00:00:00",
  "last_revision_date": "2013-11-12T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 SPIP (versions 2.x) du 09 novembre    2013",
      "url": "http://www.spip.net/fr_article5646.html"
    }
  ],
  "reference": "CERTA-2013-AVI-626",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2013-11-12T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eSPIP\u003c/span\u003e. Elles permettent \u00e0 un attaquant de provoquer\nune ex\u00e9cution de code arbitraire \u00e0 distance, une atteinte \u00e0 la\nconfidentialit\u00e9 des donn\u00e9es et une injection de code indirecte \u00e0\ndistance (XSS).\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans SPIP",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 SPIP (versions 2.x) du 09 novembre 2013",
      "url": null
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 SPIP du 09 novembre 2013",
      "url": "http://www.spip.net/fr_article5648.html"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "versions ant\u00e9rieures \u00e0 SPIP 2.0.23",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    },
    {
      "description": "Versions ant\u00e9rieures \u00e0 SPIP 3.0.9",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    },
    {
      "description": "versions ant\u00e9rieures \u00e0 SPIP 2.1.22",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [],
  "initial_release_date": "2013-05-28T00:00:00",
  "last_revision_date": "2013-05-28T00:00:00",
  "links": [
    {
      "title": "Changements entre la version 2.1.21 et 2.1.22",
      "url": "http://www.spip.net/fr_article5620.html"
    },
    {
      "title": "Changements entre la version 2.0.22 et 2.0.23",
      "url": "http://www.spip.net/fr_article5621.html"
    },
    {
      "title": "Changements entre la version 3.0.8 et 3.0.9",
      "url": "http://www.spip.net/fr_article5619.html"
    }
  ],
  "reference": "CERTA-2013-AVI-329",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2013-05-28T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 corrig\u00e9e dans \u003cspan class=\"textit\"\u003eSPIP\u003c/span\u003e.\nElle permet \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans SPIP",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 SPIP du 24 mai 2013",
      "url": "http://www.spip.net/fr_article4200.html"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SPIP versions 2.0 ant\u00e9rieures \u00e0 2.0.21.",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    },
    {
      "description": "SPIP versions 3.0 ant\u00e9rieures \u00e0 3.0.3 ;",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    },
    {
      "description": "SPIP versions 2.1 ant\u00e9rieures \u00e0 2.1.16 ;",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nMettre SPIP \u00e0 jour en version 3.0.3, 2.1.16 ou 2.0.21. L\u0027\u00e9cran de\ns\u00e9curit\u00e9 a \u00e9galement \u00e9t\u00e9 mis \u00e0 jour en version 1.1.3.\n",
  "cves": [],
  "initial_release_date": "2012-07-04T00:00:00",
  "last_revision_date": "2012-07-04T00:00:00",
  "links": [],
  "reference": "CERTA-2012-AVI-366",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2012-07-04T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    }
  ],
  "summary": "Une faille a \u00e9t\u00e9 corrig\u00e9e dans \u003cspan class=\"textit\"\u003eSPIP\u003c/span\u003e. La\nvuln\u00e9rabilit\u00e9 n\u0027est pas d\u00e9crite par l\u0027\u00e9diteur, mais elle est jug\u00e9e\ncritique.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans SPIP",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Annonce de la version 3.0.3 de SPIP du 03 juillet 2012",
      "url": "http://www.spip-contrib.net/SPIP-3-0-3-2-1-16-et-2-0-21-a-l-etape-303-epate-la"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SPIP versions 2.0.x ant\u00e9rieures \u00e0 2.0.20 ;",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    },
    {
      "description": "SPIP versions 2.1.x ant\u00e9rieures \u00e0 2.1.15 ;",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    },
    {
      "description": "SPIP versions 3.0.x ant\u00e9rieures \u00e0 3.0.2.",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [],
  "initial_release_date": "2012-06-15T00:00:00",
  "last_revision_date": "2012-06-15T00:00:00",
  "links": [
    {
      "title": "Page de t\u00e9l\u00e9chargement SPIP :",
      "url": "http://www.spip.net/fr_download"
    }
  ],
  "reference": "CERTA-2012-AVI-336",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2012-06-15T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance"
    }
  ],
  "summary": "Deux vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans SPIP. Elles permettent \u00e0 un\nattaquant d\u0027effectuer une injection de code indirecte \u00e0 distance (XSS).\n",
  "title": "Vuln\u00e9rabilit\u00e9s dans SPIP",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Annonce de mises \u00e0 jour SPIP du 13 juin 2012",
      "url": "http://archives.rezo.net/archives/spip-ann.mbox/RFBCFCK2NSMQU5EK43IDWVTYNXXIC76V/"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Versions ant\u00e9rieures \u00e0 SPIP 2.1.14 ;",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    },
    {
      "description": "versions ant\u00e9rieures \u00e0 SPIP 2.0.19 ;",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    },
    {
      "description": "versions ant\u00e9rieures \u00e0 SPIP 1.9.2p.",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [],
  "initial_release_date": "2012-05-16T00:00:00",
  "last_revision_date": "2012-05-16T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 SPIP 28 avril 2012 :",
      "url": "http://www.spip.net/fr_article4200.html"
    }
  ],
  "reference": "CERTA-2012-AVI-280",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2012-05-16T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eSPIP\u003c/span\u003e. Elles concernent des erreurs PHP, et un\ndysfonctionnement javacript.\n",
  "title": "Vuln\u00e9rabilit\u00e9s dans SPIP",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 SPIP du 28 avril 2012",
      "url": null
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Versions ant\u00e9rieures \u00e0 SPIP 1.9.2o ;",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    },
    {
      "description": "versions ant\u00e9rieures \u00e0 SPIP 2.0.18 ;",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    },
    {
      "description": "versions ant\u00e9rieures \u00e0 SPIP 2.1.13.",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [],
  "initial_release_date": "2012-04-23T00:00:00",
  "last_revision_date": "2012-04-23T00:00:00",
  "links": [],
  "reference": "CERTA-2012-AVI-227",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2012-04-23T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance"
    }
  ],
  "summary": "Plusieurs vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eSPIP\u003c/span\u003e. Elles sont majoritairement de type \u00ab\ninjection de code indirecte \u00e0 distance \u00bb (XSS) mais aucune pr\u00e9cision n\u0027a\n\u00e9t\u00e9 donn\u00e9e par l\u0027\u00e9diteur.\n",
  "title": "Vuln\u00e9rabilit\u00e9s dans SPIP",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 SPIP du 23 avril 2012",
      "url": "http://archives.rezo.net/archives/spip.mbox/J5US6ZZVZ6WTD3XVT64TFHI2B6OV6YYZ/"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SPIP versions 2.1.x ant\u00e9rieures \u00e0 2.1.12.",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    },
    {
      "description": "SPIP versions 1.9.x ant\u00e9rieures \u00e0 1.9.2n ;",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    },
    {
      "description": "SPIP versions 2.0.x ant\u00e9rieures \u00e0 2.0.17 ;",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nPlusieurs vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans SPIP :\n\n-   un utilisateur authentifi\u00e9 peut \u00e9lever ses privil\u00e8ges au sein de\n    SPIP et en devenir administrateur ;\n-   il est possible d\u0027afficher le chemin d\u0027installation ;\n-   une injection de code indirecte \u00e0 distance est r\u00e9alisable.\n\n## Solution\n\nLes versions 1.9.2n, 2.0.17 et 2.1.12 corrigent ces vuln\u00e9rabilit\u00e9s. La\nmise \u00e0 jour de l\u0027\u00e9cran de s\u00e9curit\u00e9 (derni\u00e8re version en date du 5\nnovembre 2011) est recommand\u00e9e mais ne suffit pas pour les branches 2.0\net 2.1.\n",
  "cves": [],
  "initial_release_date": "2011-11-21T00:00:00",
  "last_revision_date": "2011-11-21T00:00:00",
  "links": [],
  "reference": "CERTA-2011-AVI-654",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2011-11-21T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "Des vuln\u00e9rabilit\u00e9s dans \u003cspan class=\"textit\"\u003eSPIP\u003c/span\u003e permettent une\n\u00e9l\u00e9vation de privil\u00e8ges dans l\u0027application et une injection de code\nindirecte \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9s dans SPIP",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Annonce de SPIP du 17 novembre 2011",
      "url": "http://archives.rezo.net/archives/spip-ann.mbox/2011/11/"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SPIP versions 2.0 ant\u00e9rieures \u00e0 2.0.16 ;",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    },
    {
      "description": "SPIP versions 2.1 ant\u00e9rieures \u00e0 2.1.11.",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    },
    {
      "description": "SPIP versions 1.9.2 ant\u00e9rieures \u00e0 1.9.2k ;",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nPlusieurs vuln\u00e9rabilit\u00e9s, non d\u00e9taill\u00e9es par l\u0027\u00e9diteur, ont \u00e9t\u00e9\nd\u00e9couvertes dans SPIP. Elles permettent de r\u00e9aliser des injections SQL\n(versions 1.9.2 uniquement), et d\u0027obtenir le chemin complet\nd\u0027installation du logiciel (versions 2.0 et 2.1). \u00c0 noter que d\u00e8s la\nsortie de la version 3.0 de SPIP, la branche 1.9.2 ne sera plus\nmaintenue.\n\n## Solution\n\nMettre SPIP \u00e0 jour en version 1.9.2k, 2.0.16 ou 2.1.11.\n",
  "cves": [],
  "initial_release_date": "2011-09-23T00:00:00",
  "last_revision_date": "2011-09-23T00:00:00",
  "links": [
    {
      "title": "Page de t\u00e9l\u00e9chargement de SPIP :",
      "url": "http://www.spip.net/fr_download"
    }
  ],
  "reference": "CERTA-2011-AVI-533",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2011-09-23T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection SQL"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "Plusieurs vuln\u00e9rabilit\u00e9s dans \u003cspan class=\"textit\"\u003eSPIP\u003c/span\u003e\npermettent de r\u00e9aliser des injections SQL et d\u0027obtenir des informations\nsur le chemin d\u0027installation.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans SPIP",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Message des d\u00e9veloppeurs de SPIP du 23 septembre 2011 dans leur liste de diffusion",
      "url": null
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Toutes les versions 2.1.x de SPIP ant\u00e9rieures \u00e0 2.1.9 ;",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    },
    {
      "description": "toutes les versions 2.0.x de SPIP ant\u00e9rieures \u00e0 2.0.14 ;",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    },
    {
      "description": "toutes les versions 1.9.x de SPIP ant\u00e9rieures \u00e0 1.9.2j.",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nUne vuln\u00e9rabilit\u00e9, non d\u00e9taill\u00e9e par l\u0027\u00e9diteur, a \u00e9t\u00e9 d\u00e9couverte dans\nSPIP. L\u0027exploitation de celle-ci permet de r\u00e9aliser des injections de\ncode indirectes.\n\n## Solution\n\nMettre SPIP \u00e0 jour en version 2.1.9, 2.0.14 ou 1.9.2j.\n",
  "cves": [],
  "initial_release_date": "2011-03-28T00:00:00",
  "last_revision_date": "2011-03-28T00:00:00",
  "links": [],
  "reference": "CERTA-2011-AVI-170",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2011-03-28T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 dans \u003cspan class=\"textit\"\u003eSPIP\u003c/span\u003e permet de\nr\u00e9aliser des injections de code indirectes.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans SPIP",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Annonce de la version 2.1.9 de SPIP du 25 mars 2011",
      "url": "http://www.spip-contrib.net/Mise-a-jour-de-securite-SPIP-2-1-9"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SPIP versions 2.0.8 et ant\u00e9rieures ;",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    },
    {
      "description": "SPIP versions 1.9.x ant\u00e9rieures \u00e0 1.9.2i.",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nUne vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans SPIP. L\u0027exploitation de cette\nvuln\u00e9rabilit\u00e9 permet d\u0027ex\u00e9cuter du code arbitraire \u00e0 distance.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [],
  "initial_release_date": "2009-08-06T00:00:00",
  "last_revision_date": "2009-08-06T00:00:00",
  "links": [],
  "reference": "CERTA-2009-AVI-310",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2009-08-06T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 dans \u003cspan class=\"textit\"\u003eSPIP\u003c/span\u003e permet\nd\u0027ex\u00e9cuter du code arbitraire \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans SPIP",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Alerte de s\u00e9curit\u00e9 SPIP du 06 ao\u00fbt 2009",
      "url": "http://www.spip-contrib.net/Alerte-securite-SPIP-nouvelle"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SPIP versions 2.0.1 et ant\u00e9rieures ;",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    },
    {
      "description": "SPIP versions 1.8.3 et ant\u00e9rieures.",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    },
    {
      "description": "SPIP versions 1.9.2f et ant\u00e9rieures ;",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nPlusieurs vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans SPIP. Leur exploitation\npermet d\u0027ex\u00e9cuter du code arbitraire \u00e0 distance, de r\u00e9aliser des\ninjections SQL et des attaques de type cross-site scripting.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2008-5813",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-5813"
    },
    {
      "name": "CVE-2008-5812",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-5812"
    }
  ],
  "initial_release_date": "2008-12-26T00:00:00",
  "last_revision_date": "2009-01-05T00:00:00",
  "links": [],
  "reference": "CERTA-2008-AVI-612",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2008-12-26T00:00:00.000000"
    },
    {
      "description": "ajout des r\u00e9f\u00e9rences CVE associ\u00e9es.",
      "revision_date": "2009-01-05T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Injection SQL"
    }
  ],
  "summary": "Plusieurs vuln\u00e9rabilit\u00e9s dans \u003cspan class=\"textit\"\u003eSPIP\u003c/span\u003e\npermettent d\u0027ex\u00e9cuter du code arbitraire \u00e0 distance, de r\u00e9aliser des\ninjections SQL et des attaques en \u003cspan class=\"textit\"\u003ecross-site\nscripting\u003c/span\u003e.\n",
  "title": "Vuln\u00e9rabilit\u00e9s dans SPIP",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Annonce de la version 2.02 de SPIP du 23 d\u00e9cembre 2008",
      "url": "http://zine.spip.org/spip.php?article65"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SPIP versions 1.9 Alpha 2 (5539).",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    },
    {
      "description": "SPIP versions 1.8.2-e et ant\u00e9rieures ;",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nSPIP est un gestionnaire de contenu bas\u00e9 sur le langage php. Un manque\nde contr\u00f4le dans les param\u00e8tres id_article et id_forum du script\nforum.php3 permettent \u00e0 un utilisateur distant mal intentionn\u00e9 de\nr\u00e9aliser de l\u0027injection de code SQL dans les requ\u00eates effectu\u00e9es par ce\nscript. Il peut ainsi porter atteinte soit \u00e0 la confidentialit\u00e9 soit \u00e0\nl\u0027int\u00e9grit\u00e9 des donn\u00e9es contenues dans la base de donn\u00e9es adjointe \u00e0\nSPIP.\n\n## Solution\n\nLa vuln\u00e9rabilit\u00e9 est corrig\u00e9e dans la derni\u00e8re version (snapshot 5546)\ndisponible via Subversion (SVN).\n",
  "cves": [],
  "initial_release_date": "2006-02-08T00:00:00",
  "last_revision_date": "2006-02-08T00:00:00",
  "links": [
    {
      "title": "Site de SPIP :",
      "url": "http://www.spip.net"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Secunia :",
      "url": "http://www.secunia.com/advisories/18676"
    }
  ],
  "reference": "CERTA-2006-AVI-058",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2006-02-08T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 dans SPIP permet \u00e0 un utilisateur distant mal\nintentionn\u00e9 de porter atteinte \u00e0 la confidentialit\u00e9 ou \u00e0 l\u0027int\u00e9grit\u00e9 des\ndonn\u00e9es du site web vuln\u00e9rable.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans SPIP",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Secunia #SA18676 du 01 f\u00e9vrier 2006",
      "url": null
    }
  ]
}

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:spip:spip:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "spip",
            "vendor": "spip",
            "versions": [
              {
                "lessThanOrEqual": "4.3.1",
                "status": "affected",
                "version": "4.3.0",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "4.2.15",
                "status": "affected",
                "version": "4.2.0",
                "versionType": "custom"
              },
              {
                "lessThan": "4.1.18",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-8517",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-06T20:29:04.243583Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-06T20:30:45.388Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SPIP",
          "vendor": "SPIP",
          "versions": [
            {
              "lessThanOrEqual": "4.3.1",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.2.15",
              "status": "affected",
              "version": "4.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.1.18",
              "status": "affected",
              "version": "4.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:spip:spip:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "4.3.1",
                  "versionStartIncluding": "4.3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:spip:spip:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "4.2.15",
                  "versionStartIncluding": "4.2.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:spip:spip:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "4.1.18",
                  "versionStartIncluding": "4.1.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Louka Jacques-Chevallier"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Arthur Deloffre"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "SPIP before 4.3.2, 4.2.16, and \n4.1.18 is vulnerable to a command injection issue. A \nremote and unauthenticated attacker can execute arbitrary operating system commands by sending a crafted multipart file upload HTTP request.\u003cbr\u003e"
            }
          ],
          "value": "SPIP before 4.3.2, 4.2.16, and \n4.1.18 is vulnerable to a command injection issue. A \nremote and unauthenticated attacker can execute arbitrary operating system commands by sending a crafted multipart file upload HTTP request."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-88",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-88 OS Command Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-73",
              "description": "CWE-73 External Control of File Name or Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-22T12:11:38.221Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "technical-description"
          ],
          "url": "https://thinkloveshare.com/hacking/spip_preauth_rce_2024_part_2_a_big_upload/"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-3-2-SPIP-4-2-16-SPIP-4-1-18.html"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vulncheck.com/advisories/spip-upload-rce"
        },
        {
          "tags": [
            "exploit",
            "technical-description"
          ],
          "url": "https://vozec.fr/researchs/spip-preauth-rce-2024-big-upload/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "SPIP Bigup Multipart File Upload OS Command Injection",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2024-8517",
    "datePublished": "2024-09-06T15:55:35.349Z",
    "dateReserved": "2024-09-06T14:37:41.755Z",
    "dateUpdated": "2025-11-22T12:11:38.221Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:spip:spip:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "spip",
            "vendor": "spip",
            "versions": [
              {
                "lessThan": "4.3.0-alpha2",
                "status": "affected",
                "version": "4.3.0-alpha",
                "versionType": "custom"
              },
              {
                "lessThan": "4.2.13",
                "status": "affected",
                "version": "4.2.0",
                "versionType": "semver"
              },
              {
                "lessThan": "4.1.16",
                "status": "affected",
                "version": "4.1.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-7954",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-23T18:26:49.808289Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-23T18:31:44.888Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SPIP",
          "vendor": "SPIP",
          "versions": [
            {
              "lessThan": "4.3.0-alpha2",
              "status": "affected",
              "version": "4.3.0-alpha",
              "versionType": "custom"
            },
            {
              "lessThan": "4.2.13",
              "status": "affected",
              "version": "4.2.0",
              "versionType": "semver"
            },
            {
              "lessThan": "4.1.16",
              "status": "affected",
              "version": "4.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:spip:spip:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.3.0-alpha2",
                  "versionStartIncluding": "4.3.0-alpha",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:spip:spip:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.2.13",
                  "versionStartIncluding": "4.2.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:spip:spip:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.1.16",
                  "versionStartIncluding": "4.1.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Louka Jacques-Chevallier"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthenticated attacker can execute arbitrary PHP as the SPIP user by sending a crafted HTTP request.\u003cbr\u003e"
            }
          ],
          "value": "The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthenticated attacker can execute arbitrary PHP as the SPIP user by sending a crafted HTTP request."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-242",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-242 Code Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-95",
              "description": "CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code (\u0027Eval Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1286",
              "description": "CWE-1286 Improper Validation of Syntactic Correctness of Input",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-22T12:12:14.668Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vulncheck.com/advisories/spip-porte-plume"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-3-0-alpha2-SPIP-4-2-13-SPIP-4.html"
        },
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://thinkloveshare.com/hacking/spip_preauth_rce_2024_part_1_the_feather/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "SPIP porte_plume Plugin Arbitrary PHP Execution",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2024-7954",
    "datePublished": "2024-08-23T17:43:20.967Z",
    "dateReserved": "2024-08-19T18:16:30.180Z",
    "dateUpdated": "2025-11-22T12:12:14.668Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}