Description (CNA)
SPIP before 4.4.8 allows cross-site scripting (XSS) in the private area via malicious iframe tags. The application does not properly sandbox or escape iframe content in the back-office, allowing an attacker to inject and execute malicious scripts. The fix adds a sandbox attribute to iframe tags in the private area. This vulnerability is not mitigated by the SPIP security screen.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| SPIP / SPIP | affected 4.4.0 before 4.4.8 |
CWE
No CWE identifiers supplied.
References
- https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-8.html
- https://git.spip.net/spip/spip
- https://www.vulncheck.com/advisories/spip-cross-site-scripting-via-iframe-tags-in-private-area
ADP enrichment
No English description supplied.
No references supplied.