CVE-2016-9997

Name of the Vulnerable Software and Affected Versions SPIP version 3.1.x

Description The issue is related to a Reflected Cross Site Scripting problem. It affects the /ecrire/exec/puce statut.php endpoint, specifically involving the id parameter. An example of exploitation is through a /ecrire/?exec=puce statut URL.

Recommendations For SPIP version 3.1.x, as a temporary workaround, consider restricting access to the /ecrire/exec/puce statut.php endpoint until a patch is available. Avoid using the id parameter in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.