logo

Database

Server-side request forgery (SSRF) In spip

Description

ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to conduct server side request forgery (SSRF) attacks via a URL in the var_url parameter in a valider_xml action.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Package
Affected version
Patched versions

Aliases

1. CVE-2016-79992. NVD-2016-79993. OSV-DEBIAN-2016-79994. OSV-2016-79995. GCVE-2016-79996. SECURITY-TRACKER-CVE-2016-7999

References

1. http://www.securityfocus.com/bid/934512. https://core.spip.net/projects/spip/repository/revisions/231883. https://core.spip.net/projects/spip/repository/revisions/23193

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.