{"id":"CVE-2023-27372","aliases":["DEBIAN-CVE-2023-27372","DLA-3347-1","DSA-5367-1","EUVD-2023-31148","GHSA-jc3f-vxgp-6jw9","UBUNTU-CVE-2023-27372","USN-7318-1"],"status":"published","title":"SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because...","description":"SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.99682,"percentile":0.9995,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-502"],"published":"2023-02-27T00:00:00Z","modified":"2026-10-26T18:00:33Z","exploits":[{"source":"metasploit","id":"exploit/multi/http/spip_rce_form","title":"SPIP form PHP Injection","type":"exploit","platform":"Linux,PHP,Unix,Windows","date":"2023-02-27","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/spip_rce_form"},{"source":"pocgithub","id":"nuts7/CVE-2023-27372","title":"nuts7/CVE-2023-27372","date":"2023-06-19","url":"https://github.com/nuts7/CVE-2023-27372"},{"source":"exploitdb","id":"EDB-51536","title":"SPIP v4.2.0 - Remote Code Execution (Unauthenticated)","type":"webapps","platform":"php","date":"2023-06-20","verified":true,"url":"https://www.exploit-db.com/exploits/51536"},{"source":"pocgithub","id":"Chocapikk/CVE-2023-27372","title":"Chocapikk/CVE-2023-27372","date":"2023-06-25","url":"https://github.com/Chocapikk/CVE-2023-27372"},{"source":"pocgithub","id":"dream434/CVE-2023-27372","title":"dream434/CVE-2023-27372","date":"2023-07-01","url":"https://github.com/dream434/CVE-2023-27372"},{"source":"pocgithub","id":"0SPwn/CVE-2023-27372-PoC","title":"0SPwn/CVE-2023-27372-PoC","date":"2023-07-05","url":"https://github.com/0SPwn/CVE-2023-27372-PoC"},{"source":"pocgithub","id":"izzz0/CVE-2023-27372-POC","title":"izzz0/CVE-2023-27372-POC","date":"2023-07-11","url":"https://github.com/izzz0/CVE-2023-27372-POC"},{"source":"pocgithub","id":"Ap0dexMe0/CVE-2023-27372","title":"Ap0dexMe0/CVE-2023-27372","date":"2023-07-31","url":"https://github.com/Ap0dexMe0/CVE-2023-27372"},{"source":"pocgithub","id":"redboltsec/CVE-2023-27372-PoC","title":"redboltsec/CVE-2023-27372-PoC","date":"2023-09-07","url":"https://github.com/redboltsec/CVE-2023-27372-PoC"},{"source":"pocgithub","id":"1amthebest1/CVE-2023-27372","title":"1amthebest1/CVE-2023-27372","date":"2024-08-15","url":"https://github.com/1amthebest1/CVE-2023-27372"},{"source":"pocgithub","id":"1Ronkkeli/spip-cve-2023-27372-rce","title":"1Ronkkeli/spip-cve-2023-27372-rce","date":"2025-04-28","url":"https://github.com/1Ronkkeli/spip-cve-2023-27372-rce"},{"source":"pocgithub","id":"G01d3nW01f/cve-2023-27372","title":"G01d3nW01f/cve-2023-27372","date":"2025-07-25","url":"https://github.com/G01d3nW01f/cve-2023-27372"},{"source":"pocgithub","id":"KirolosKhairy/CVE-2023-27372","title":"KirolosKhairy/CVE-2023-27372","date":"2025-12-26","url":"https://github.com/KirolosKhairy/CVE-2023-27372"},{"source":"pocgithub","id":"estebanzarate/CVE-2023-27372-SPIP-4.2.1-Unauthenticated-RCE-PoC","title":"estebanzarate/CVE-2023-27372-SPIP-4.2.1-Unauthenticated-RCE-PoC","date":"2026-02-24","url":"https://github.com/estebanzarate/CVE-2023-27372-SPIP-4.2.1-Unauthenticated-RCE-PoC"},{"source":"pocgithub","id":"scriniariii/CVE-2023-27372","title":"scriniariii/CVE-2023-27372","date":"2026-03-07","url":"https://github.com/scriniariii/CVE-2023-27372"},{"source":"nuclei","id":"CVE-2023-27372","title":"SPIP - Remote Command Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27372.yaml"}],"fixes":[{"ecosystem":"Debian:13","package":"spip","fixed_in":["4.1.8+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"spip","fixed_in":["4.1.8+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"spip","fixed_in":["3.2.11-3+deb11u7"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"spip","fixed_in":["3.1.4-4~deb9u5ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"spip","fixed_in":["3.2.7-1ubuntu0.1+esm2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:13","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.8+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.8+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-1+deb10u10"}]}],"versions":["3.2.4-1","3.2.4-1+deb10u1","3.2.4-1+deb10u2","3.2.4-1+deb10u3","3.2.4-1+deb10u4","3.2.4-1+deb10u5","3.2.4-1+deb10u6","3.2.4-1+deb10u7","3.2.4-1+deb10u8","3.2.4-1+deb10u9"],"bundled":2},{"source":"osv","ecosystem":"Debian:11","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.11-3+deb11u7"}]}],"versions":["3.2.11-3","3.2.11-3+deb11u1","3.2.11-3+deb11u2","3.2.11-3+deb11u3","3.2.11-3+deb11u4","3.2.11-3+deb11u5","3.2.11-3+deb11u6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.20-1","3.0.21-1","3.0.21-1ubuntu1","3.0.21-1ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-4~deb9u5ubuntu0.1~esm2"}]}],"versions":["3.1.4-3","3.1.4-4~deb9u3build0.18.04.1","3.1.4-4~deb9u5build0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-1ubuntu0.1+esm2"}]}],"versions":["3.2.4-1","3.2.5-1","3.2.7-1","3.2.7-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.11-3","3.2.12-1","4.0.2-1","4.0.4-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-4~deb9u5ubuntu0.1~esm2"}]}],"versions":["3.1.4-3","3.1.4-4~deb9u3build0.18.04.1","3.1.4-4~deb9u5build0.18.04.1"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-1ubuntu0.1+esm2"}]}],"versions":["3.2.4-1","3.2.5-1","3.2.7-1","3.2.7-1ubuntu0.1"],"bundled":8}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"spip","product":"spip"}],"references":[{"url":"https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-2-1-SPIP-4-1-8-SPIP-4-0-10-et.html","tags":["x_transferred","Release Notes","advisory","report"]},{"url":"https://git.spip.net/spip/spip/commit/5aedf49b89415a4df3eb775eee3801a2b4b88266","tags":["x_transferred","Patch","fix","report"]},{"url":"https://git.spip.net/spip/spip/commit/96fbeb38711c6706e62457f2b732a652a04a409d","tags":["x_transferred","Patch","fix","report"]},{"url":"https://www.debian.org/security/2023/dsa-5367","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"http://packetstormsecurity.com/files/171921/SPIP-Remote-Command-Execution.html","tags":["x_transferred","web"]},{"url":"http://packetstormsecurity.com/files/173044/SPIP-4.2.1-Remote-Code-Execution.html","tags":["x_transferred","web"]},{"url":"https://packetstorm.news/files/id/173044","tags":["exploit","web"]},{"url":"https://packetstorm.news/files/id/171921","tags":["exploit","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27372"},{"url":"https://github.com/advisories/GHSA-jc3f-vxgp-6jw9"},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-27372","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-27372","tags":["report"]},{"url":"https://blog.spip.net/Mise-a-jour-sortie-de-SPIP-4-2-2-SPIP-4-1-9-SPIP-4-0-11-et-SPIP-3-2-19.html","tags":["report"]},{"url":"https://git.spip.net/spip/svp/commit/d463bc549b13bc45651051f83760e8ce274c98d9","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-27372","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7318-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-23638","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-28959","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-28960","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-28961","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-37155","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-24258","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-8517","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-27372","description":"SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1.","status":"published","published":"2023-02-28T00:00:00Z","modified":"2025-03-11T14:27:45.289Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:35:26.63732Z"}],"euvd":[{"id":"EUVD-2023-31148","description":"SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1.","status":"published","published":"2023-02-28T00:00:00Z","modified":"2025-03-11T14:27:45Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:53:07.779422Z"}],"ghsa":[{"id":"GHSA-jc3f-vxgp-6jw9","title":"SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because...","description":"SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1.","status":"published","published":"2023-02-28T21:30:16Z","modified":"2025-03-11T15:30:53Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:00:12.792548Z"}],"nvd":[{"id":"CVE-2023-27372","description":"SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1.","status":"published","published":"2023-02-28T20:15:10.243Z","modified":"2026-06-17T05:44:53.83Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:07:47.623983Z"}],"osv":[{"id":"CVE-2023-27372","description":"SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1.","status":"published","published":"2023-02-28T20:15:10.243Z","modified":"2026-03-15T22:44:30.495178Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:31.135751Z"},{"id":"DEBIAN-CVE-2023-27372","description":"SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1.","status":"published","published":"2023-02-28T20:15:10.243Z","modified":"2026-10-26T18:00:33.925458933Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:39.679062Z"},{"id":"UBUNTU-CVE-2023-27372","description":"SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1.","status":"published","published":"2023-02-28T20:15:00Z","modified":"2026-04-07T11:15:15.266457Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:54:20.198616Z"},{"id":"DLA-3347-1","title":"spip - security update","status":"published","published":"2023-02-27T00:00:00Z","modified":"2026-03-09T01:18:17.084669Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DSA-5367-1","title":"spip - security update","status":"published","published":"2023-03-02T00:00:00Z","modified":"2026-03-09T02:10:04.767083Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"USN-7318-1","title":"spip vulnerabilities","description":"It was discovered that svg-sanitizer, vendored in SPIP, did not properly\nsanitize SVG/XML content. An attacker could possibly use this issue to\nperform cross site scripting. This issue only affected Ubuntu 24.10.\n(CVE-2022-23638)\n\nIt was discovered that SPIP did not properly sanitize certain inputs. A\nremote attacker could possibly use this issue to perform cross site\nscripting. This issue only affected Ubuntu 18.04 LTS. (CVE-2022-28959)\n\nIt was discovered that SPIP did not properly sanitize certain inputs. A\nremote attacker could possibly use this issue to perform PHP injection\nattacks. This issue only affected Ubuntu 18.04 LTS. (CVE-2022-28960)\n\nIt was discovered that SPIP did not properly sanitize certain inputs. A\nremote attacker could possibly use this issue to perform SQL injection\nattacks. This issue only affected Ubuntu 18.04 LTS. (CVE-2022-28961)\n\nIt was discovered that SPIP did not properly sanitize certain inputs. A\nremote authenticated attacker could possibly use this issue to execute\narbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2022-37155)\n\nIt was discovered that SPIP did not properly sanitize certain inputs. A\nremote attacker could possibly use this issue to perform SQL injection\nattacks. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.\n(CVE-2023-24258)\n\nIt was discovered that SPIP did not properly handle serialization under\ncertain circumstances. A remote attacker could possibly use this issue to\nexecute arbitrary code. This issue only affected Ubuntu 18.04 LTS and\nUbuntu 20.04 LTS. (CVE-2023-27372)\n\nIt was discovered that SPIP did not properly sanitize HTTP requests. A\nremote attacker could possibly use this issue to execute arbitrary code.\n(CVE-2024-8517)\n","status":"published","published":"2025-03-04T00:21:21Z","modified":"2026-04-27T18:02:20.676823681Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}