Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2023-27372 Details

Description

SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:9.8 CRITICALVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CNA: CISA-ADPCVSS-B:9.8 CRITICALVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://packetstorm.news/files/id/171921	CISA-ADP
https://packetstorm.news/files/id/173044	CISA-ADP
http://packetstormsecurity.com/files/171921/SPIP-Remote-Command-Execution.html	CVE
http://packetstormsecurity.com/files/173044/SPIP-4.2.1-Remote-Code-Execution.html	CVE
https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-2-1-SPIP-4-1-8-SPIP-4-0-10-et.html	CVE	Release Notes
https://git.spip.net/spip/spip/commit/5aedf49b89415a4df3eb775eee3801a2b4b88266	CVE	Patch
https://git.spip.net/spip/spip/commit/96fbeb38711c6706e62457f2b732a652a04a409d	CVE	Patch
https://www.debian.org/security/2023/dsa-5367	CVE	Third Party Advisory
http://packetstormsecurity.com/files/171921/SPIP-Remote-Command-Execution.html	[email protected]
http://packetstormsecurity.com/files/173044/SPIP-4.2.1-Remote-Code-Execution.html	[email protected]
https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-2-1-SPIP-4-1-8-SPIP-4-0-10-et.html	[email protected]	Release Notes
https://git.spip.net/spip/spip/commit/5aedf49b89415a4df3eb775eee3801a2b4b88266	[email protected]	Patch
https://git.spip.net/spip/spip/commit/96fbeb38711c6706e62457f2b732a652a04a409d	[email protected]	Patch
https://www.debian.org/security/2023/dsa-5367	[email protected]	Third Party Advisory

see all 14 references

Weakness Enumeration

CWE-ID	CWE Name	Source
NVD-CWE-noinfo	Insufficient Information to Classify Weakness	[email protected]
CWE-502	Deserialization of Untrusted Data	CISA-ADP

Affected Products

Product	Versions
spip spip	< 3.2.18 >= 4.0.0, < 4.0.10 >= 4.1.0, < 4.1.8 4.2.0 - 4.2.0 alpha
CPE cpe:2.3:a:spip:spip:::::::: cpe:2.3:a:spip:spip:4.2.0:-:::::: cpe:2.3:a:spip:spip:4.2.0:alpha:::::: cpe:2.3:a:spip:spip:4.2.0:alpha2:::::: Remediation No remediation found in references.
debian debian linux	11.0
CPE cpe:2.3:o:debian:debian_linux:11.0:::::::* Remediation No remediation found in references.

Change History

9 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	[email protected]
Jun 17, 2026	CVE Modified	CISA-ADP
Mar 11, 2025	CVE Modified	CISA-ADP
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Jun 21, 2023	CVE Modified	[email protected]
Apr 18, 2023	CVE Modified	[email protected]
Mar 6, 2023	Initial Analysis	[email protected]
Mar 2, 2023	CVE Modified	[email protected]