CVE-2012-2151

Published: Aug 14, 2012Modified: Apr 29, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Multiple cross-site scripting (XSS) vulnerabilities in SPIP 1.9.x before 1.9.2.o, 2.0.x before 2.0.18, and 2.1.x before 2.1.13 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Affected (5)

Products: Spip: Spip

Spip

1 product

Spip

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Spip Spip	Version 1.9.1
Spip Spip	Version 1.9.2
Spip Spip	Version 1.9
Spip Spip	Version 2.0
Spip Spip	Version 2.1

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (18)

http://archives.rezo.net/archives/spip-en.mbox/U5QUZ6WJRAJC7H5BR7W5SQG6WCD3PXL7/

Source: secalert@redhat.com

http://secunia.com/advisories/48939

Source: secalert@redhat.com

Vendor Advisory

http://www.debian.org/security/2012/dsa-2461

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2012/04/30/4

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2012/05/01/4

Source: secalert@redhat.com

http://www.osvdb.org/81473

Source: secalert@redhat.com

http://www.securityfocus.com/bid/53216

Source: secalert@redhat.com

http://www.securitytracker.com/id?1026970

Source: secalert@redhat.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/75104

Source: secalert@redhat.com

http://archives.rezo.net/archives/spip-en.mbox/U5QUZ6WJRAJC7H5BR7W5SQG6WCD3PXL7/