CVE-2023-27372
100Vexday Risk Score
Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.
ssvc Actcvss 9.8epss 100%
de la publicación al arma111 días
Publicada en NVD28 feb
1ª PoC+111d
metasploit27 feb
VulnCheck+64d
probabilidad de explotación
100%top 1% de las CVE
explotación observada
síVulnCheck
31 exploit(s) público(s)
SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
n/a · n/aPoCs públicas encontradas — 31✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/51536githubgithub.com/nuts7/CVE-2023-27372★ 69githubgithub.com/Chocapikk/CVE-2023-27372★ 8githubgithub.com/0SPwn/CVE-2023-27372-PoC★ 6githubgithub.com/Ap0dexMe0/CVE-2023-27372★ 3githubgithub.com/1Ronkkeli/spip-cve-2023-27372-rce★ 2githubgithub.com/izzz0/CVE-2023-27372-POC★ 2githubgithub.com/estebanzarate/CVE-2023-27372-SPIP-4.2.1-Unauthenticated-RCE-PoC★ 1githubgithub.com/redboltsec/CVE-2023-27372-PoC★ 0githubgithub.com/G01d3nW01f/cve-2023-27372★ 0githubgithub.com/1amthebest1/CVE-2023-27372★ 0githubgithub.com/scriniariii/CVE-2023-27372★ 0githubgithub.com/dream434/CVE-2023-27372★ 0githubgithub.com/KirolosKhairy/CVE-2023-27372★ 0vulncheckvulncheck.com/xdb/5a4ed18cbe25no verificadocve_referencepacketstormsecurity.com/files/171921/SPIP-Remote-Command-Execution.htmlno verificadocve_referencepacketstormsecurity.com/files/173044/SPIP-4.2.1-Remote-Code-Execution.htmlno verificadovulncheckvulncheck.com/xdb/ab5928501616no verificadocve_referencepacketstorm.news/files/id/173044no verificadovulncheckvulncheck.com/xdb/a7444b0210e4no verificadocve_referencepacketstorm.news/files/id/171921no verificadovulncheckvulncheck.com/xdb/268a1b1d077ano verificadovulncheckvulncheck.com/xdb/04607676aadbno verificadovulncheckvulncheck.com/xdb/3ce4547b4b42no verificadovulncheckvulncheck.com/xdb/81284a3b5750no verificadovulncheckvulncheck.com/xdb/2f302d530f10no verificadovulncheckvulncheck.com/xdb/32c0ec161ef4no verificadovulncheckvulncheck.com/xdb/70071bb09a8bno verificadovulncheckvulncheck.com/xdb/e1f2d4ed2e6bno verificadovulncheckvulncheck.com/xdb/7fb69b769d96no verificadovulncheckvulncheck.com/xdb/b8a19b503bfcno verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
Referencias
http://packetstormsecurity.com/files/171921/SPIP-Remote-Command-Execution.htmlhttp://packetstormsecurity.com/files/173044/SPIP-4.2.1-Remote-Code-Execution.htmlhttps://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-2-1-SPIP-4-1-8-SPIP-4-0-10-et.htmlhttps://git.spip.net/spip/spip/commit/5aedf49b89415a4df3eb775eee3801a2b4b88266https://git.spip.net/spip/spip/commit/96fbeb38711c6706e62457f2b732a652a04a409dhttps://packetstorm.news/files/id/171921https://packetstorm.news/files/id/173044https://www.debian.org/security/2023/dsa-5367