Fluid Attacks Database

Description

The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthenticated attacker can execute arbitrary PHP as the SPIP user by sending a crafted HTTP request.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 13	spip	>=0 <4.3.0+dfsg-1	4.3.0+dfsg-1
debian 14	spip	>=0 <4.3.0+dfsg-1	4.3.0+dfsg-1

Aliases

1. CVE-2024-79542. NVD-2024-79543. OSV-DEBIAN-2024-79544. OSV-2024-79545. SECURITY-TRACKER-CVE-2024-7954

References

1. https://vulncheck.com/cve/CVE-2024-79542. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-7954.yaml3. https://github.com/Chocapikk/CVE-2024-79544. https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/spip_porte_plume_previsu_rce.rb

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.