CVE-2016-3154 Deserialization in n/a

Critical 9.8 Published 8 Apr 2016 Updated 5 Aug 2024

Remote attackers can execute arbitrary PHP code in SPIP CMS via crafted serialized objects in the encoder_contexte_ajax function.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2016-3154?

CVE-2016-3154 is a critical unsafe deserialization vulnerability in Spip Spip, published on 8 Apr 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The encoder_contexte_ajax function in ecrire/inc/filtres.php in SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object.

Weakness: CWE-94

Which versions are affected by CVE-2016-3154?

It affects 1 product.

Products include Spip Spip.

How do I fix CVE-2016-3154?

Upgrade to a fixed version.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2016-3154 being exploited?

There is no known exploitation of CVE-2016-3154 in the wild and no public exploit code.

All Spip Spip vulnerabilities

Sources

Also known as DEBIAN-CVE-2016-3154, GHSA-5fwq-26jx-xp73, UBUNTU-CVE-2016-3154.