logo

Database

Server side template injection In spip

Description

SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. A remote and unauthenticated attacker can execute arbitrary operating system commands by sending a crafted multipart file upload HTTP request.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Package
Affected version
Patched versions

Aliases

1. CVE-2024-85172. NVD-2024-85173. OSV-DEBIAN-2024-85174. OSV-2024-85175. SECURITY-TRACKER-CVE-2024-8517

References

1. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8517.yaml2. https://github.com/Chocapikk/CVE-2024-85173. https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/spip_bigup_unauth_rce.rb

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.