{"id":"CVE-2021-44122","aliases":["DEBIAN-CVE-2021-44122","DLA-2867-1","DSA-5028-1","EUVD-2021-30978","GHSA-fv46-9fmf-2p7g","UBUNTU-CVE-2021-44122","USN-5482-1","USN-5482-2"],"status":"published","title":"SPIP 4.0.0 is affected by a Cross Site Request Forgery (CSRF) vulnerability in ecrire/public...","description":"SPIP 4.0.0 is affected by a Cross Site Request Forgery (CSRF) vulnerability in ecrire/public/aiguiller.php, ecrire/public/balises.php, ecrire/balise/formulaire_.php. To exploit the vulnerability, a visitor must visit a malicious website which redirects to the SPIP website. It is also possible to combine XSS vulnerabilities in SPIP 4.0.0 to exploit it. The vulnerability allows an authenticated attacker to execute malicious code without the knowledge of the user on the website (CSRF).","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.00491,"percentile":0.42735,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-352"],"published":"2021-12-22T00:00:00Z","modified":"2026-10-23T18:03:38Z","fixes":[{"ecosystem":"Debian:13","package":"spip","fixed_in":["3.2.12-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"spip","fixed_in":["3.2.12-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"spip","fixed_in":["3.1.4-4~deb9u5build0.18.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"spip","fixed_in":["3.2.7-1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:13","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.12-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.12-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-4~deb9u4+deb9u2"}]}],"versions":["3.1.4-2","3.1.4-3","3.1.4-3~deb9u1","3.1.4-4~deb9u1","3.1.4-4~deb9u2","3.1.4-4~deb9u3","3.1.4-4~deb9u4","3.1.4-4~deb9u4+deb9u1"],"bundled":4},{"source":"osv","ecosystem":"Debian:10","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-1+deb10u5"}]}],"versions":["3.2.4-1","3.2.4-1+deb10u1","3.2.4-1+deb10u2","3.2.4-1+deb10u3","3.2.4-1+deb10u4"],"bundled":4},{"source":"osv","ecosystem":"Debian:11","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.11-3+deb11u1"}]}],"versions":["3.2.11-3"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.20-1","3.0.21-1","3.0.21-1ubuntu1","3.0.21-1ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-4~deb9u5build0.18.04.1"}]}],"versions":["3.1.4-3","3.1.4-4~deb9u3build0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-1ubuntu0.1"}]}],"versions":["3.2.4-1","3.2.5-1","3.2.7-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-4~deb9u5build0.18.04.1"}]}],"versions":["3.1.4-3","3.1.4-4~deb9u3build0.18.04.1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-1ubuntu0.1"}]}],"versions":["3.2.4-1","3.2.5-1","3.2.7-1"],"bundled":4}],"products":[{"vendor":"spip","product":"spip"}],"references":[{"url":"https://git.spip.net/spip/spip/commit/1b8e4f404c2441c15ca6540b9a6d8e50cff219db","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44122"},{"url":"https://github.com/advisories/GHSA-fv46-9fmf-2p7g"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-44122","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-44122","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5482-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5482-2","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44122","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-28984","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-44118","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-44120","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-44123","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-26846","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-26847","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-44122","description":"SPIP 4.0.0 is affected by a Cross Site Request Forgery (CSRF) vulnerability in ecrire/public/aiguiller.php, ecrire/public/balises.php, ecrire/balise/formulaire_.php. To exploit the vulnerability, a visitor must visit a malicious website which redirects to the SPIP website. It is also possible to combine XSS vulnerabilities in SPIP 4.0.0 to exploit it. The vulnerability allows an authenticated attacker to execute malicious code without the knowledge of the user on the website (CSRF).","status":"published","published":"2022-01-26T11:47:55Z","modified":"2024-08-04T04:10:17.382Z","updated_at":"2026-11-02T14:33:01.166399Z"}],"euvd":[{"id":"EUVD-2021-30978","description":"SPIP 4.0.0 is affected by a Cross Site Request Forgery (CSRF) vulnerability in ecrire/public/aiguiller.php, ecrire/public/balises.php, ecrire/balise/formulaire_.php. To exploit the vulnerability, a visitor must visit a malicious website which redirects to the SPIP website. It is also possible to combine XSS vulnerabilities in SPIP 4.0.0 to exploit it. The vulnerability allows an authenticated attacker to execute malicious code without the knowledge of the user on the website (CSRF).","status":"published","published":"2022-01-26T11:47:55Z","modified":"2024-08-04T04:10:17Z","updated_at":"2026-11-03T03:24:12.599691Z"}],"ghsa":[{"id":"GHSA-fv46-9fmf-2p7g","title":"SPIP 4.0.0 is affected by a Cross Site Request Forgery (CSRF) vulnerability in ecrire/public...","description":"SPIP 4.0.0 is affected by a Cross Site Request Forgery (CSRF) vulnerability in ecrire/public/aiguiller.php, ecrire/public/balises.php, ecrire/balise/formulaire_.php. To exploit the vulnerability, a visitor must visit a malicious website which redirects to the SPIP website. It is also possible to combine XSS vulnerabilities in SPIP 4.0.0 to exploit it. The vulnerability allows an authenticated attacker to execute malicious code without the knowledge of the user on the website (CSRF).","status":"published","published":"2022-01-27T00:01:21Z","modified":"2023-02-03T05:05:16Z","cwes":["CWE-352"],"updated_at":"2026-11-02T14:53:42.900002Z"}],"nvd":[{"id":"CVE-2021-44122","description":"SPIP 4.0.0 is affected by a Cross Site Request Forgery (CSRF) vulnerability in ecrire/public/aiguiller.php, ecrire/public/balises.php, ecrire/balise/formulaire_.php. To exploit the vulnerability, a visitor must visit a malicious website which redirects to the SPIP website. It is also possible to combine XSS vulnerabilities in SPIP 4.0.0 to exploit it. The vulnerability allows an authenticated attacker to execute malicious code without the knowledge of the user on the website (CSRF).","status":"published","published":"2022-01-26T12:15:07.887Z","modified":"2026-06-17T04:11:55.45Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:07:03.821385Z"}],"osv":[{"id":"CVE-2021-44122","description":"SPIP 4.0.0 is affected by a Cross Site Request Forgery (CSRF) vulnerability in ecrire/public/aiguiller.php, ecrire/public/balises.php, ecrire/balise/formulaire_.php. To exploit the vulnerability, a visitor must visit a malicious website which redirects to the SPIP website. It is also possible to combine XSS vulnerabilities in SPIP 4.0.0 to exploit it. The vulnerability allows an authenticated attacker to execute malicious code without the knowledge of the user on the website (CSRF).","status":"published","published":"2022-01-26T12:15:07.887Z","modified":"2026-03-14T11:16:39.632595Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:21.877444Z"},{"id":"DEBIAN-CVE-2021-44122","description":"SPIP 4.0.0 is affected by a Cross Site Request Forgery (CSRF) vulnerability in ecrire/public/aiguiller.php, ecrire/public/balises.php, ecrire/balise/formulaire_.php. To exploit the vulnerability, a visitor must visit a malicious website which redirects to the SPIP website. It is also possible to combine XSS vulnerabilities in SPIP 4.0.0 to exploit it. The vulnerability allows an authenticated attacker to execute malicious code without the knowledge of the user on the website (CSRF).","status":"published","published":"2022-01-26T12:15:07.887Z","modified":"2026-10-23T18:03:38.915694703Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:35.799676Z"},{"id":"UBUNTU-CVE-2021-44122","description":"SPIP 4.0.0 is affected by a Cross Site Request Forgery (CSRF) vulnerability in ecrire/public/aiguiller.php, ecrire/public/balises.php, ecrire/balise/formulaire_.php. To exploit the vulnerability, a visitor must visit a malicious website which redirects to the SPIP website. It is also possible to combine XSS vulnerabilities in SPIP 4.0.0 to exploit it. The vulnerability allows an authenticated attacker to execute malicious code without the knowledge of the user on the website (CSRF).","status":"published","published":"2022-01-26T12:15:00Z","modified":"2026-04-07T10:43:38.058168Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:29.220315Z"},{"id":"DLA-2867-1","title":"spip - security update","status":"published","published":"2021-12-29T00:00:00Z","modified":"2026-03-09T01:20:25.782869Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DSA-5028-1","title":"spip - security update","status":"published","published":"2021-12-22T00:00:00Z","modified":"2026-03-09T02:11:43.419845Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"USN-5482-1","title":"spip vulnerabilities","description":"\nIt was discovered that SPIP incorrectly validated inputs. An authenticated\nattacker could possibly use this issue to execute arbitrary code.\nThis issue only affected Ubuntu 18.04 LTS. (CVE-2020-28984)\n\nCharles Fol and Théo Gordyjan discovered that SPIP is vulnerable to Cross\nSite Scripting (XSS). If a user were tricked into browsing a malicious SVG\nfile, an attacker could possibly exploit this issue to execute arbitrary\ncode. This issue was only fixed in Ubuntu 21.10. (CVE-2021-44118,\nCVE-2021-44120, CVE-2021-44122, CVE-2021-44123)\n\nIt was discovered that SPIP incorrectly handled certain forms. A remote\nauthenticated editor could possibly use this issue to execute arbitrary code,\nand a remote unauthenticated attacker could possibly use this issue to obtain\nsensitive information. (CVE-2022-26846, CVE-2022-26847)\n","status":"published","published":"2022-06-16T16:22:11Z","modified":"2026-04-27T16:12:12.417691Z","updated_at":"2026-11-02T16:58:16.20937Z"},{"id":"USN-5482-2","title":"spip vulnerabilities","description":"USN-5482-1 fixed several vulnerabilities in SPIP. This update provides\nthe corresponding updates for Ubuntu 20.04 LTS for CVE-2021-44118,\nCVE-2021-44120, CVE-2021-44122 and CVE-2021-44123.\n\nOriginal advisory details:\n\n \n It was discovered that SPIP incorrectly validated inputs. An authenticated\n attacker could possibly use this issue to execute arbitrary code.\n This issue only affected Ubuntu 18.04 LTS. (CVE-2020-28984)\n \n Charles Fol and Théo Gordyjan discovered that SPIP is vulnerable to Cross\n Site Scripting (XSS). If a user were tricked into browsing a malicious SVG\n file, an attacker could possibly exploit this issue to execute arbitrary\n code. This issue was only fixed in Ubuntu 21.10. (CVE-2021-44118,\n CVE-2021-44120, CVE-2021-44122, CVE-2021-44123)\n \n It was discovered that SPIP incorrectly handled certain forms. A remote\n authenticated editor could possibly use this issue to execute arbitrary code,\n and a remote unauthenticated attacker could possibly use this issue to obtain\n sensitive information. (CVE-2022-26846, CVE-2022-26847)\n","status":"published","published":"2023-03-02T10:15:19Z","modified":"2026-04-27T16:11:43.785457Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}