CVE-2023-27372 in the critical feed json
SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled.
published 2023-02-28 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-31148
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 99.7%
- EPSS 99.7% chance of exploitation in 30 days, percentile 99.9%
- public exploits
- 2
- Metasploit, Exploit-DB, plus a Nuclei check
Summary
SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1.
Patch / fix
- spip spip 3.2.18, 4.0.10, 4.1.8
- spip Debian 14, Debian 13 4.1.8+dfsg-1
debian advisories DEBIAN-CVE-2023-27372
- spip Ubuntu Pro 18.04 LTS 3.1.4-4~deb9u5ubuntu0.1~esm2
- spip Ubuntu Pro 20.04 LTS 3.2.7-1ubuntu0.1+esm2
ubuntu advisories UBUNTU-CVE-2023-27372
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- git.spip.net/spip/spip@5aedf49 commit
- git.spip.net/spip/spip@96fbeb3 commit
Timeline
- First public exploit (Metasploit exploit/multi/http/spip_rce_form)
- Published
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- total
- Assessed
- 19 mo ago
Exploit prediction
99.68% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit exploit/multi/http/spip_rce_form SPIP form PHP Injection metasploit exploit, excellent rank, 2023-02-27
- EDB-51536 SPIP v4.2.0 - Remote Code Execution (Unauthenticated) webapps, 2023-06-20
- Nuclei template SPIP - Remote Command Execution nuclei detection template
- packetstorm.news https://packetstorm.news/files/id/173044 referenced PoC, tagged "exploit" by a source, unverified
- packetstorm.news https://packetstorm.news/files/id/171921 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Classification
- Weakness
-
- CWE-502 Deserialization of Untrusted Data
References
-
git.spip.net
/spip/spip/commit/5aedf49b89415a4df3eb775eee3801a2b4b88266
patch
-
git.spip.net
/spip/spip/commit/96fbeb38711c6706e62457f2b732a652a04a409d
patch
-
packetstorm.news
/files/id/173044
exploit
-
packetstorm.news
/files/id/171921
exploit
-
debian.org
/security/2023/dsa-5367
vendor-advisory, third-party-advisory
-
blog.spip.net
/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-2-1-SPIP-4-1-8-SPIP-4-0-10-et.html
release-notes
- packetstormsecurity.com /files/171921/SPIP-Remote-Command-Execution.html
- packetstormsecurity.com /files/173044/SPIP-4.2.1-Remote-Code-Execution.html
Sources
- CVE List CVE-2023-27372
- NVD CVE-2023-27372
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.