CVE-2021-44122 Cross-site request forgery in n/a
An authenticated attacker can execute malicious code via CSRF in SPIP, potentially leading to code execution if combined with XSS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-44122?
CVE-2021-44122 is a high-severity vulnerability in Spip Spip, published on 26 Jan 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
SPIP 4.0.0 is affected by a Cross Site Request Forgery (CSRF) vulnerability in ecrire/public/aiguiller.php, ecrire/public/balises.php, ecrire/balise/formulaire_.php. To exploit the vulnerability, a visitor must visit a malicious website which redirects to the SPIP website. It is also possible to combine XSS vulnerabilities in SPIP 4.0.0 to exploit it. The vulnerability allows an authenticated attacker to execute malicious code without the knowledge of the user on the website (CSRF).
Weakness: CWE-352
Which versions are affected by CVE-2021-44122?
It affects 1 product.
Products include Spip Spip.
How do I fix CVE-2021-44122?
Upgrade to a fixed version.
Is CVE-2021-44122 being exploited?
There is no known exploitation of CVE-2021-44122 in the wild and no public exploit code.
Other vulnerabilities in Spip Spip
Sources
Also known as DEBIAN-CVE-2021-44122, GHSA-fv46-9fmf-2p7g, UBUNTU-CVE-2021-44122.