SPIP 4.0.0 is affected by a Cross Site Request Forgery (CSRF) vulnerability in ecrire/public/aiguiller.php, ecrire/public/balises.php, ecri…

published 2022-01-26 4y ago modified 2026-06-17 4mo ago also EUVD-2021-30978

cvss: 8.8; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 42%
public exploits: 0; none known

SPIP 4.0.0 is affected by a Cross Site Request Forgery (CSRF) vulnerability in ecrire/public/aiguiller.php, ecrire/public/balises.php, ecrire/balise/formulaire_.php. To exploit the vulnerability, a visitor must visit a malicious website which redirects to the SPIP website. It is also possible to combine XSS vulnerabilities in SPIP 4.0.0 to exploit it. The vulnerability allows an authenticated attacker to execute malicious code without the knowledge of the user on the website (CSRF).

Patch / fix

distros 2 links 1

debian ubuntu

spip Debian 14, Debian 13 3.2.12-1

debian advisories DEBIAN-CVE-2021-44122

spip Ubuntu 18.04 LTS 3.1.4-4~deb9u5build0.18.04.1
spip Ubuntu 20.04 LTS 3.2.7-1ubuntu0.1

ubuntu advisories UBUNTU-CVE-2021-44122

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

git.spip.net/spip/spip@1b8e4f4 commit

Is CVE-2021-44122 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Exploit prediction

0.49% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD	2.0	6.8	AV:N/AC:M/Au:N/C:P/I:P/A:P

Classification

Weakness

CWE-352 Cross-Site Request Forgery

References

git.spip.net /spip/spip/commit/1b8e4f404c2441c15ca6540b9a6d8e50cff219db
patch, vendor-advisory

Sources

CVE List CVE-2021-44122
NVD CVE-2021-44122

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.