CVE-2023-27372
100Vexday Risk Score
Corrija agora. Ela exploração observada pelo VulnCheck e tem exploit funcional público.
ssvc Actcvss 9.8epss 100%
da publicação à arma111 dias
Publicada no NVD28 de fev.
1ª PoC+111d
metasploit27 de fev.
VulnCheck+64d
probabilidade de exploração
100%top 1% das CVEs
exploração observada
simVulnCheck
31 exploit(s) público(s)
SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
n/a · n/aPoCs públicas encontradas — 31✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/51536githubgithub.com/nuts7/CVE-2023-27372★ 69githubgithub.com/Chocapikk/CVE-2023-27372★ 8githubgithub.com/0SPwn/CVE-2023-27372-PoC★ 6githubgithub.com/Ap0dexMe0/CVE-2023-27372★ 3githubgithub.com/1Ronkkeli/spip-cve-2023-27372-rce★ 2githubgithub.com/izzz0/CVE-2023-27372-POC★ 2githubgithub.com/estebanzarate/CVE-2023-27372-SPIP-4.2.1-Unauthenticated-RCE-PoC★ 1githubgithub.com/dream434/CVE-2023-27372★ 0githubgithub.com/redboltsec/CVE-2023-27372-PoC★ 0githubgithub.com/1amthebest1/CVE-2023-27372★ 0githubgithub.com/G01d3nW01f/cve-2023-27372★ 0githubgithub.com/KirolosKhairy/CVE-2023-27372★ 0githubgithub.com/scriniariii/CVE-2023-27372★ 0vulncheckvulncheck.com/xdb/3ce4547b4b42não verificadovulncheckvulncheck.com/xdb/81284a3b5750não verificadovulncheckvulncheck.com/xdb/2f302d530f10não verificadovulncheckvulncheck.com/xdb/32c0ec161ef4não verificadovulncheckvulncheck.com/xdb/70071bb09a8bnão verificadovulncheckvulncheck.com/xdb/e1f2d4ed2e6bnão verificadovulncheckvulncheck.com/xdb/7fb69b769d96não verificadovulncheckvulncheck.com/xdb/b8a19b503bfcnão verificadovulncheckvulncheck.com/xdb/5a4ed18cbe25não verificadocve_referencepacketstormsecurity.com/files/171921/SPIP-Remote-Command-Execution.htmlnão verificadocve_referencepacketstormsecurity.com/files/173044/SPIP-4.2.1-Remote-Code-Execution.htmlnão verificadocve_referencepacketstorm.news/files/id/171921não verificadocve_referencepacketstorm.news/files/id/173044não verificadovulncheckvulncheck.com/xdb/268a1b1d077anão verificadovulncheckvulncheck.com/xdb/ab5928501616não verificadovulncheckvulncheck.com/xdb/a7444b0210e4não verificadovulncheckvulncheck.com/xdb/04607676aadbnão verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
Referências
http://packetstormsecurity.com/files/171921/SPIP-Remote-Command-Execution.htmlhttp://packetstormsecurity.com/files/173044/SPIP-4.2.1-Remote-Code-Execution.htmlhttps://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-2-1-SPIP-4-1-8-SPIP-4-0-10-et.htmlhttps://git.spip.net/spip/spip/commit/5aedf49b89415a4df3eb775eee3801a2b4b88266https://git.spip.net/spip/spip/commit/96fbeb38711c6706e62457f2b732a652a04a409dhttps://packetstorm.news/files/id/171921https://packetstorm.news/files/id/173044https://www.debian.org/security/2023/dsa-5367