CVE-2019-11071

HIGH

SPIP 3.1.0-3.1.9 and 3.2.0-3.2.3 - Authenticated Remote Code Execution via var_memotri Mishandling

Title source: llm
STIX 2.1

Description

SPIP 3.1 before 3.1.10 and 3.2 before 3.2.4 allows authenticated visitors to execute arbitrary code on the host server because var_memotri is mishandled.

References (6)

Core 6
Core References
Third Party Advisory x_refsource_misc
https://github.com/spip/SPIP/compare/1e3872c...9861a47
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2019/dsa-4429
Vendor Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/4536-1/

Scores

CVSS v3 8.8
EPSS 0.0258
EPSS Percentile 83.3%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-20
Status published
Products (2)
debian/debian_linux 9.0
spip/spip 3.1.0 - 3.1.10
Published Apr 10, 2019
Tracked Since Feb 18, 2026