CVE-2017-9736 Command injection in n/a
Remote attackers can execute arbitrary code on SPIP installations by injecting shell metacharacters into the host field.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-9736?
CVE-2017-9736 is a critical command injection vulnerability in Spip Spip, published on 17 Jun 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SPIP 3.1.x before 3.1.6 and 3.2.x before Beta 3 does not remove shell metacharacters from the host field, allowing a remote attacker to cause remote code execution.
Weakness: CWE-78
Which versions are affected by CVE-2017-9736?
It affects 1 product.
Products include Spip Spip.
How do I fix CVE-2017-9736?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2017-9736 being exploited?
There is no known exploitation of CVE-2017-9736 in the wild and no public exploit code.
Other vulnerabilities in Spip Spip
Sources
Also known as DEBIAN-CVE-2017-9736, DSA-3890-1, GHSA-x85m-mcx3-934m.