PT-2022-23844

CVE-2022-37155

Published

2022-07-26

Updated

2025-03-04

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SPIP versions 3.1.13 through 4.1.2

Description The issue allows remote authenticated users to execute arbitrary code via the oups parameter. This enables attackers to perform remote code execution (RCE) on affected systems.

Recommendations For SPIP versions 3.1.13 through 4.1.2, consider restricting access to the oups parameter to minimize the risk of exploitation until a patch is available.

Exploitability

Exploit

Fix

Impacts

Researchers

Abyss Watcher

Spawnzii

Vendors

Affected products

Weakness enumeration

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

Related identifiers