{"id":"CVE-2022-37155","aliases":["DEBIAN-CVE-2022-37155","DSA-5190-1","EUVD-2022-39808","GHSA-7c7w-25xj-4mp8","UBUNTU-CVE-2022-37155","USN-7318-1"],"status":"published","title":"RCE in SPIP 3.1.13 through 4.1.2 allows remote authenticated users to execute arbitrary code via...","description":"RCE in SPIP 3.1.13 through 4.1.2 allows remote authenticated users to execute arbitrary code via the _oups parameter.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.39966,"percentile":0.98637,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-94"],"published":"2022-07-26T00:00:00Z","modified":"2026-11-03T08:01:33Z","fixes":[{"ecosystem":"Debian:13","package":"spip","fixed_in":["4.1.5+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"spip","fixed_in":["4.1.5+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"spip","fixed_in":["3.2.4-1+deb10u9"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"spip","fixed_in":["3.2.11-3+deb11u5"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"spip","fixed_in":["3.1.4-4~deb9u5ubuntu0.1~esm2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:13","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.5+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.5+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-1+deb10u9"}]}],"versions":["3.2.4-1","3.2.4-1+deb10u1","3.2.4-1+deb10u2","3.2.4-1+deb10u3","3.2.4-1+deb10u4","3.2.4-1+deb10u5","3.2.4-1+deb10u6","3.2.4-1+deb10u7","3.2.4-1+deb10u8"]},{"source":"osv","ecosystem":"Debian:11","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.11-3+deb11u5"}]}],"versions":["3.2.11-3","3.2.11-3+deb11u1","3.2.11-3+deb11u2","3.2.11-3+deb11u3","3.2.11-3+deb11u4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.20-1","3.0.21-1","3.0.21-1ubuntu1","3.0.21-1ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-4~deb9u5ubuntu0.1~esm2"}]}],"versions":["3.1.4-3","3.1.4-4~deb9u3build0.18.04.1","3.1.4-4~deb9u5build0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.11-3","3.2.12-1","4.0.2-1","4.0.4-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-4~deb9u5ubuntu0.1~esm2"}]}],"versions":["3.1.4-3","3.1.4-4~deb9u3build0.18.04.1","3.1.4-4~deb9u5build0.18.04.1"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-1ubuntu0.1+esm2"}]}],"versions":["3.2.4-1","3.2.5-1","3.2.7-1","3.2.7-1ubuntu0.1"],"bundled":8}],"products":[{"vendor":"spip","product":"spip"}],"references":[{"url":"https://spawnzii.github.io/posts/2022/07/how-we-have-pwned-root-me-in-2022/","tags":["x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-1-5-SPIP-4-0-8-et-SPIP-3-2-16.html","tags":["x_transferred","Patch","Release Notes","Vendor Advisory","fix"]},{"url":"https://pastebin.com/ZH7CPc8X","tags":["x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://github.com/Abyss-W4tcher/ab4yss-wr4iteups/blob/ffa980faa9e3598d49d6fb7def4f7a67cfb5f427/SPIP%20-%20Pentest/SPIP%204.1.2/SPIP_4.1.2_AUTH_RCE/SPIP_4.1.2_AUTH_RCE_Abyss_Watcher_12_07_22.md","tags":["x_transferred","Exploit","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-37155"},{"url":"https://spawnzii.github.io/posts/2022/07/how-we-have-pwned-root-me-in-2022"},{"url":"https://github.com/advisories/GHSA-7c7w-25xj-4mp8"},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-37155","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-37155","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-37155","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7318-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-23638","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-28959","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-28960","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-28961","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-24258","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-27372","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-8517","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-37155","description":"RCE in SPIP 3.1.13 through 4.1.2 allows remote authenticated users to execute arbitrary code via the _oups parameter.","status":"published","published":"2022-12-13T00:00:00Z","modified":"2025-04-22T15:42:51.715Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:34:26.977054Z"}],"euvd":[{"id":"EUVD-2022-39808","description":"RCE in SPIP 3.1.13 through 4.1.2 allows remote authenticated users to execute arbitrary code via the _oups parameter.","status":"published","published":"2022-12-13T00:00:00Z","modified":"2025-04-22T15:42:51Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:17.280298Z"}],"ghsa":[{"id":"GHSA-7c7w-25xj-4mp8","title":"RCE in SPIP 3.1.13 through 4.1.2 allows remote authenticated users to execute arbitrary code via...","description":"RCE in SPIP 3.1.13 through 4.1.2 allows remote authenticated users to execute arbitrary code via a GET parameter","status":"published","published":"2022-12-14T00:30:23Z","modified":"2025-04-22T18:33:04Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:01:59.626328Z"}],"nvd":[{"id":"CVE-2022-37155","description":"RCE in SPIP 3.1.13 through 4.1.2 allows remote authenticated users to execute arbitrary code via the _oups parameter.","status":"published","published":"2022-12-14T00:15:09.973Z","modified":"2026-06-17T04:54:40.483Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:07:33.649381Z"}],"osv":[{"id":"CVE-2022-37155","description":"RCE in SPIP 3.1.13 through 4.1.2 allows remote authenticated users to execute arbitrary code via the _oups parameter.","status":"published","published":"2022-12-14T00:15:09.973Z","modified":"2026-03-14T11:50:33.426782Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:26.53798Z"},{"id":"DEBIAN-CVE-2022-37155","description":"RCE in SPIP 3.1.13 through 4.1.2 allows remote authenticated users to execute arbitrary code via the _oups parameter.","status":"published","published":"2022-12-14T00:15:09.973Z","modified":"2026-11-03T08:01:33.308356413Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T08:25:01.007408Z"},{"id":"UBUNTU-CVE-2022-37155","description":"RCE in SPIP 3.1.13 through 4.1.2 allows remote authenticated users to execute arbitrary code via the _oups parameter.","status":"published","published":"2022-12-14T00:15:00Z","modified":"2026-04-07T10:54:34.849144Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:54.697021Z"},{"id":"DSA-5190-1","title":"spip - security update","status":"published","published":"2022-07-26T00:00:00Z","modified":"2026-03-09T02:08:32.687039Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"USN-7318-1","title":"spip vulnerabilities","description":"It was discovered that svg-sanitizer, vendored in SPIP, did not properly\nsanitize SVG/XML content. An attacker could possibly use this issue to\nperform cross site scripting. This issue only affected Ubuntu 24.10.\n(CVE-2022-23638)\n\nIt was discovered that SPIP did not properly sanitize certain inputs. A\nremote attacker could possibly use this issue to perform cross site\nscripting. This issue only affected Ubuntu 18.04 LTS. (CVE-2022-28959)\n\nIt was discovered that SPIP did not properly sanitize certain inputs. A\nremote attacker could possibly use this issue to perform PHP injection\nattacks. This issue only affected Ubuntu 18.04 LTS. (CVE-2022-28960)\n\nIt was discovered that SPIP did not properly sanitize certain inputs. A\nremote attacker could possibly use this issue to perform SQL injection\nattacks. This issue only affected Ubuntu 18.04 LTS. (CVE-2022-28961)\n\nIt was discovered that SPIP did not properly sanitize certain inputs. A\nremote authenticated attacker could possibly use this issue to execute\narbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2022-37155)\n\nIt was discovered that SPIP did not properly sanitize certain inputs. A\nremote attacker could possibly use this issue to perform SQL injection\nattacks. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.\n(CVE-2023-24258)\n\nIt was discovered that SPIP did not properly handle serialization under\ncertain circumstances. A remote attacker could possibly use this issue to\nexecute arbitrary code. This issue only affected Ubuntu 18.04 LTS and\nUbuntu 20.04 LTS. (CVE-2023-27372)\n\nIt was discovered that SPIP did not properly sanitize HTTP requests. A\nremote attacker could possibly use this issue to execute arbitrary code.\n(CVE-2024-8517)\n","status":"published","published":"2025-03-04T00:21:21Z","modified":"2026-04-27T18:02:20.676823681Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}