CVE catalog

CVE-2021-44118

DEBIAN-CVE-2021-44118

[CVE catalog]

Severity
Unknown
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.77% · Oct 25, 2026

SPIP 4.0.0 is affected by a Cross Site Scripting (XSS) vulnerability. To exploit the vulnerability, a visitor must browse to a malicious SVG file. The vulnerability allows an authenticated attacker to inject malicious code running on the client side into web pages visited by other users (stored XSS).

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianspip133.2.12-1fixed
Debianspip143.2.12-1fixed
Ubuntuspip20.043.2.4-1vulnerable
Ubuntuspip20.043.2.5-1vulnerable
Ubuntuspip20.043.2.7-1vulnerable
Ubuntuspip20.043.2.7-1ubuntu0.1fixed
Ubuntuspippro3.0.20-1vulnerable
Ubuntuspippro3.0.21-1vulnerable
Ubuntuspippro3.0.21-1ubuntu1vulnerable
Ubuntuspippro3.0.21-1ubuntu1+esm1vulnerable
Ubuntuspip18.043.1.4-3vulnerable
Ubuntuspip18.043.1.4-4~deb9u3build0.18.04.1vulnerable
Ubuntuspip18.043.1.4-4~deb9u5build0.18.04.1fixed
Ubuntuspip20.043.2.4-1vulnerable
Ubuntuspip20.043.2.5-1vulnerable
Ubuntuspip20.043.2.7-1vulnerable
Ubuntuspip20.043.2.7-1ubuntu0.1fixed
Debianspip103.2.4-1vulnerable
Debianspip103.2.4-1+deb10u1vulnerable
Debianspip103.2.4-1+deb10u2vulnerable
Debianspip103.2.4-1+deb10u3vulnerable
Debianspip103.2.4-1+deb10u4vulnerable
Debianspip103.2.4-1+deb10u5fixed
Debianspip113.2.11-3vulnerable
Debianspip113.2.11-3+deb11u1fixed
Debianspip93.1.4-2vulnerable
Debianspip93.1.4-3vulnerable
Debianspip93.1.4-3~deb9u1vulnerable
Debianspip93.1.4-4~deb9u1vulnerable
Debianspip93.1.4-4~deb9u2vulnerable
Debianspip93.1.4-4~deb9u3vulnerable
Debianspip93.1.4-4~deb9u4vulnerable
Debianspip93.1.4-4~deb9u4+deb9u1vulnerable
Debianspip93.1.4-4~deb9u4+deb9u2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianspipdeb133.2.12-1Not reportedDEBIAN-CVE-2021-44118Not reported
Debianspipdeb143.2.12-1Not reportedDEBIAN-CVE-2021-44118Not reported
Ubuntuspipdeb20.043.2.7-1ubuntu0.1Not reportedUSN-5482-2Not reported
Ubuntuspipdeb18.043.1.4-4~deb9u5build0.18.04.1Not reportedUBUNTU-CVE-2021-44118Not reported
Ubuntuspipdeb20.043.2.7-1ubuntu0.1Not reportedUBUNTU-CVE-2021-44118Not reported
Debianspipdeb103.2.4-1+deb10u5Not reportedDSA-5028-1Not reported
Debianspipdeb113.2.11-3+deb11u1Not reportedDSA-5028-1Not reported
Debianspipdeb93.1.4-4~deb9u4+deb9u2Not reportedDLA-2867-1Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 13 (Trixie)]

  • [spip]Unknown
    Details (9)

    • 4.4.15+dfsg-0+deb13u1 · all · trixie

      Fixed · Fixed: 3.2.12-1

      pypi · spip · debian · 13

    • 4.4.15+dfsg-0+deb13u1 · all · trixie

      Fixed · Fixed: 3.2.12-1

      pypi · spip · debian · 13

    • 4.4.15+dfsg-0+deb13u1 · all · trixie-security · Historical version

      Fixed · Fixed: 3.2.12-1

      pypi · spip · debian · 13

    • 4.4.19+dfsg-0+deb13u1 · all · trixie-security · Historical version

      Fixed · Fixed: 3.2.12-1

      pypi · spip · debian · 13

    • 4.4.20+dfsg-0+deb13u1 · all · trixie-security · Historical version

      Fixed · Fixed: 3.2.12-1

      pypi · spip · debian · 13

    • 4.4.21+dfsg-0+deb13u1 · all · trixie-security · Historical version

      Fixed · Fixed: 3.2.12-1

      pypi · spip · debian · 13

    • 4.4.21+dfsg-0+deb13u1 · all · trixie-security

      Fixed · Fixed: 3.2.12-1

      pypi · spip · debian · 13

    • 4.4.23+dfsg-0+deb13u1 · all · trixie-security · Historical version

      Fixed · Fixed: 3.2.12-1

      pypi · spip · debian · 13

    • 4.4.28+dfsg-0+deb13u1 · all · trixie-security

      Fixed · Fixed: 3.2.12-1

      pypi · spip · debian · 13

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database]