{"id":"CVE-2020-28984","aliases":["DEBIAN-CVE-2020-28984","DLA-2505-1","DSA-4798-1","EUVD-2020-21367","GHSA-5w2r-g8c8-f3m3","UBUNTU-CVE-2020-28984","USN-5482-1"],"status":"published","title":"Improper Input Validation in SPIP","description":"prive/formulaires/configurer_preferences.php in SPIP before 3.2.8 does not properly validate the couleur, display, display_navigation, display_outils, imessage, and spip_ecran parameters.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.02194,"percentile":0.82723,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2020-11-23T21:48:53Z","modified":"2026-10-26T12:01:58Z","fixes":[{"ecosystem":"Debian:13","package":"spip","fixed_in":["3.2.8-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"spip","fixed_in":["3.2.8-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"spip","fixed_in":["3.1.4-4~deb9u4"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"spip","fixed_in":["3.1.4-4~deb9u5build0.18.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:13","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.8-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.8-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-4~deb9u4"}]}],"versions":["3.1.4-2","3.1.4-3","3.1.4-3~deb9u1","3.1.4-4~deb9u1","3.1.4-4~deb9u2","3.1.4-4~deb9u3"]},{"source":"osv","ecosystem":"Debian:10","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-1+deb10u3"}]}],"versions":["3.2.4-1","3.2.4-1+deb10u1","3.2.4-1+deb10u2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.20-1","3.0.21-1","3.0.21-1ubuntu1","3.0.21-1ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-4~deb9u5build0.18.04.1"}]}],"versions":["3.1.4-3","3.1.4-4~deb9u3build0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.4-1","3.2.5-1","3.2.7-1","3.2.7-1ubuntu0.1","3.2.7-1ubuntu0.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-4~deb9u5build0.18.04.1"}]}],"versions":["3.1.4-3","3.1.4-4~deb9u3build0.18.04.1"],"bundled":7}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"spip","product":"spip"}],"references":[{"url":"https://git.spip.net/spip/spip/commit/ae4267eba1022dabc12831ddb021c5d6e09040f8","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix","report"]},{"url":"https://git.spip.net/spip/spip/compare/v3.2.7...v3.2.8","tags":["x_refsource_MISC","x_transferred","Release Notes","Vendor Advisory","advisory","report"]},{"url":"https://www.debian.org/security/2020/dsa-4798","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/12/msg00036.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-28984"},{"url":"https://github.com/advisories/GHSA-5w2r-g8c8-f3m3"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-28984","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-28984","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5482-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-28984","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-44118","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-44120","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-44122","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-44123","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-26846","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-26847","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-28984","description":"prive/formulaires/configurer_preferences.php in SPIP before 3.2.8 does not properly validate the couleur, display, display_navigation, display_outils, imessage, and spip_ecran parameters.","status":"published","published":"2020-11-23T21:48:53Z","modified":"2024-08-04T16:48:01.703Z","updated_at":"2026-11-02T14:35:57.352161Z"}],"euvd":[{"id":"EUVD-2020-21367","description":"prive/formulaires/configurer_preferences.php in SPIP before 3.2.8 does not properly validate the couleur, display, display_navigation, display_outils, imessage, and spip_ecran parameters.","status":"published","published":"2020-11-23T21:48:53Z","modified":"2024-08-04T16:48:01Z","updated_at":"2026-11-03T03:07:08.475588Z"}],"ghsa":[{"id":"GHSA-5w2r-g8c8-f3m3","title":"Improper Input Validation in SPIP","description":"prive/formulaires/configurer_preferences.php in SPIP before 3.2.8 does not properly validate the couleur, display, display_navigation, display_outils, imessage, and spip_ecran parameters.","status":"published","published":"2022-02-15T01:40:26Z","modified":"2023-02-01T05:05:27Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:50:15.334804Z"}],"nvd":[{"id":"CVE-2020-28984","description":"prive/formulaires/configurer_preferences.php in SPIP before 3.2.8 does not properly validate the couleur, display, display_navigation, display_outils, imessage, and spip_ecran parameters.","status":"published","published":"2020-11-23T22:15:12.57Z","modified":"2026-06-17T03:10:56.667Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:06:25.394006Z"}],"osv":[{"id":"CVE-2020-28984","description":"prive/formulaires/configurer_preferences.php in SPIP before 3.2.8 does not properly validate the couleur, display, display_navigation, display_outils, imessage, and spip_ecran parameters.","status":"published","published":"2020-11-23T22:15:12.57Z","modified":"2026-10-20T10:53:13.235156376Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:16.612899Z"},{"id":"DEBIAN-CVE-2020-28984","description":"prive/formulaires/configurer_preferences.php in SPIP before 3.2.8 does not properly validate the couleur, display, display_navigation, display_outils, imessage, and spip_ecran parameters.","status":"published","published":"2020-11-23T22:15:12.57Z","modified":"2026-10-26T12:01:58.526866387Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:34.019707Z"},{"id":"UBUNTU-CVE-2020-28984","description":"prive/formulaires/configurer_preferences.php in SPIP before 3.2.8 does not properly validate the couleur, display, display_navigation, display_outils, imessage, and spip_ecran parameters.","status":"published","published":"2020-11-23T22:15:00Z","modified":"2026-04-07T10:38:12.107539Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:24.541803Z"},{"id":"DLA-2505-1","title":"spip - security update","status":"published","published":"2020-12-23T00:00:00Z","modified":"2026-03-09T01:20:32.500324Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DSA-4798-1","title":"spip - security update","status":"published","published":"2020-11-25T00:00:00Z","modified":"2026-03-09T02:08:55.876094Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"USN-5482-1","title":"spip vulnerabilities","description":"\nIt was discovered that SPIP incorrectly validated inputs. An authenticated\nattacker could possibly use this issue to execute arbitrary code.\nThis issue only affected Ubuntu 18.04 LTS. (CVE-2020-28984)\n\nCharles Fol and Théo Gordyjan discovered that SPIP is vulnerable to Cross\nSite Scripting (XSS). If a user were tricked into browsing a malicious SVG\nfile, an attacker could possibly exploit this issue to execute arbitrary\ncode. This issue was only fixed in Ubuntu 21.10. (CVE-2021-44118,\nCVE-2021-44120, CVE-2021-44122, CVE-2021-44123)\n\nIt was discovered that SPIP incorrectly handled certain forms. A remote\nauthenticated editor could possibly use this issue to execute arbitrary code,\nand a remote unauthenticated attacker could possibly use this issue to obtain\nsensitive information. (CVE-2022-26846, CVE-2022-26847)\n","status":"published","published":"2022-06-16T16:22:11Z","modified":"2026-04-27T16:12:12.417691Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}