logo

Database

Lack of data validation In spip/spip

Description

prive/formulaires/configurer_preferences.php in SPIP before 3.2.8 does not properly validate the couleur, display, display_navigation, display_outils, imessage, and spip_ecran parameters.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Package
Affected version
Patched versions

Aliases

1. CVE-2020-289842. NVD-2020-289843. OSV-2020-289844. OSV-DEBIAN-2020-289845. GCVE-2020-289846. SECURITY-TRACKER-CVE-2020-28984

References

1. https://git.spip.net/spip/spip/commit/ae4267eba1022dabc12831ddb021c5d6e09040f82. https://git.spip.net/spip/spip/compare/v3.2.7...v3.2.8

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.