CVE catalog

CVE-2021-44120

DEBIAN-CVE-2021-44120

[CVE catalog]

Severity
Unknown
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.67% · Oct 25, 2026

SPIP 4.0.0 is affected by a Cross Site Scripting (XSS) vulnerability in ecrire/public/interfaces.php, adding the function safehtml to the vulnerable fields. An editor is able to modify his personal information. If the editor has an article written and available, when a user goes to the public site and wants to read the author's information, the malicious code will be executed. The "Who are you" and "Website Name" fields are vulnerable.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianspip133.2.12-1fixed
Debianspip143.2.12-1fixed
Ubuntuspippro3.0.20-1vulnerable
Ubuntuspippro3.0.21-1vulnerable
Ubuntuspippro3.0.21-1ubuntu1vulnerable
Ubuntuspippro3.0.21-1ubuntu1+esm1vulnerable
Ubuntuspip18.043.1.4-3vulnerable
Ubuntuspip18.043.1.4-4~deb9u3build0.18.04.1vulnerable
Ubuntuspip18.043.1.4-4~deb9u5build0.18.04.1fixed
Ubuntuspip20.043.2.4-1vulnerable
Ubuntuspip20.043.2.5-1vulnerable
Ubuntuspip20.043.2.7-1vulnerable
Ubuntuspip20.043.2.7-1ubuntu0.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianspipdeb133.2.12-1Not reportedDEBIAN-CVE-2021-44120Not reported
Debianspipdeb143.2.12-1Not reportedDEBIAN-CVE-2021-44120Not reported
Ubuntuspipdeb18.043.1.4-4~deb9u5build0.18.04.1Not reportedUBUNTU-CVE-2021-44120Not reported
Ubuntuspipdeb20.043.2.7-1ubuntu0.1Not reportedUBUNTU-CVE-2021-44120Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 13 (Trixie)]

  • [spip]Unknown
    Details (9)

    • 4.4.15+dfsg-0+deb13u1 · all · trixie

      Fixed · Fixed: 3.2.12-1

      pypi · spip · debian · 13

    • 4.4.15+dfsg-0+deb13u1 · all · trixie

      Fixed · Fixed: 3.2.12-1

      pypi · spip · debian · 13

    • 4.4.15+dfsg-0+deb13u1 · all · trixie-security · Historical version

      Fixed · Fixed: 3.2.12-1

      pypi · spip · debian · 13

    • 4.4.19+dfsg-0+deb13u1 · all · trixie-security · Historical version

      Fixed · Fixed: 3.2.12-1

      pypi · spip · debian · 13

    • 4.4.20+dfsg-0+deb13u1 · all · trixie-security · Historical version

      Fixed · Fixed: 3.2.12-1

      pypi · spip · debian · 13

    • 4.4.21+dfsg-0+deb13u1 · all · trixie-security · Historical version

      Fixed · Fixed: 3.2.12-1

      pypi · spip · debian · 13

    • 4.4.21+dfsg-0+deb13u1 · all · trixie-security

      Fixed · Fixed: 3.2.12-1

      pypi · spip · debian · 13

    • 4.4.23+dfsg-0+deb13u1 · all · trixie-security · Historical version

      Fixed · Fixed: 3.2.12-1

      pypi · spip · debian · 13

    • 4.4.28+dfsg-0+deb13u1 · all · trixie-security

      Fixed · Fixed: 3.2.12-1

      pypi · spip · debian · 13

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database]