CVE-2025-71242: falha de média gravidade em SPIP
SPIP < 4.3.6 Authorization Bypass Leading to Content Disclosure
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.4%
SPIP before 4.3.6, 4.2.17, and 4.1.20 allows unauthorized content disclosure in the private area. The application does not properly check authorization when displaying content of articles and sections (rubriques) in AJAX-loaded fragments, allowing an authenticated attacker to access restricted content. This vulnerability is not mitigated by the SPIP security screen.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
SPIP · SPIPCVEs relacionadas — SPIP
No mesmo produto, das mais perigosas para as menos.
CVE-2024-8517CRITICALSPIP Bigup Multipart File Upload OS Command InjectionEPSS 94.5%CVE-2024-7954CRITICALSPIP porte_plume Plugin Arbitrary PHP ExecutionEPSS 90.1%CVE-2026-77806CRITICALCVE-2026-77806EPSS 4.5%CVE-2026-77647CRITICALCVE-2026-77647EPSS 2.3%CVE-2026-72710CRITICALSPIP < 4.4.18 RCE via editer_objet.php Job Queue InjectionEPSS 1.1%CVE-2026-27475CRITICALSPIP < 4.4.9 Insecure DeserializationEPSS 0.9%