logo

Database

Lack of data validation - Path Traversal In spip

Description

Directory traversal vulnerability in ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to enumerate the files on the system via the var_url parameter in a valider_xml action.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Package
Affected version
Patched versions

Aliases

1. CVE-2016-79822. NVD-2016-79823. OSV-DEBIAN-2016-79824. OSV-2016-79825. GCVE-2016-79826. SECURITY-TRACKER-CVE-2016-7982

References

1. https://www.exploit-db.com/exploits/405962. http://www.securityfocus.com/bid/934513. https://core.spip.net/projects/spip/repository/revisions/23200

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.