Philippe Boussin

**Name of the Vulnerable Software and Affected Versions** SPIP versions prior to 4.4.8 **Description** SPIP before version 4.4.8 contains a Cross-Site Scripting (XSS) issue in the private area due to improper handling of iframe tags. The application does not adequately sandbox or escape iframe content within the back-office, which allows an attacker to inject and execute malicious scripts. The vulnerability is not addressed by the SPIP security screen. **Recommendations** Update to SPIP version 4.4.8 or later.

**Name of the Vulnerable Software and Affected Versions** SPIP versions prior to 4.4.8 **Description** SPIP before version 4.4.8 contains a Cross-Site Scripting (XSS) issue in the public area due to inadequate detection of malicious content by the `echapper html suspect()` function. This allows an attacker to inject scripts that execute in a visitor’s browser. The SPIP security screen does not mitigate this issue. **Recommendations** Update to SPIP version 4.4.8 or later.

**Name of the Vulnerable Software and Affected Versions** SPIP versions prior to 4.4.8 **Description** The application does not properly handle iframe content in the private area, allowing an attacker to inject and execute malicious scripts through iframe tags. The issue occurs because the application does not sandbox or escape iframe content in the back-office. The fix involves adding a sandbox attribute to iframe tags within the private area. This issue is not addressed by the SPIP security screen. **Recommendations** Update to SPIP version 4.4.8 or later.

**Name of the Vulnerable Software and Affected Versions** SPIP versions prior to 4.4.8 **Description** SPIP before version 4.4.8 contains a Cross-Site Scripting (XSS) issue in the public area due to insufficient detection of malicious content by the `echapper html suspect()` function. This allows an attacker to inject scripts that can execute in a visitor’s browser. The SPIP security screen does not mitigate this issue. **Recommendations** Update SPIP to version 4.4.8 or later.