CVE catalog

CVE-2021-44122

DEBIAN-CVE-2021-44122

[CVE catalog]

Severity
Unknown
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.49% · Oct 25, 2026

SPIP 4.0.0 is affected by a Cross Site Request Forgery (CSRF) vulnerability in ecrire/public/aiguiller.php, ecrire/public/balises.php, ecrire/balise/formulaire_.php. To exploit the vulnerability, a visitor must visit a malicious website which redirects to the SPIP website. It is also possible to combine XSS vulnerabilities in SPIP 4.0.0 to exploit it. The vulnerability allows an authenticated attacker to execute malicious code without the knowledge of the user on the website (CSRF).

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianspip133.2.12-1fixed
Debianspip143.2.12-1fixed
Ubuntuspippro3.0.20-1vulnerable
Ubuntuspippro3.0.21-1vulnerable
Ubuntuspippro3.0.21-1ubuntu1vulnerable
Ubuntuspippro3.0.21-1ubuntu1+esm1vulnerable
Ubuntuspip18.043.1.4-3vulnerable
Ubuntuspip18.043.1.4-4~deb9u3build0.18.04.1vulnerable
Ubuntuspip18.043.1.4-4~deb9u5build0.18.04.1fixed
Ubuntuspip20.043.2.4-1vulnerable
Ubuntuspip20.043.2.5-1vulnerable
Ubuntuspip20.043.2.7-1vulnerable
Ubuntuspip20.043.2.7-1ubuntu0.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianspipdeb133.2.12-1Not reportedDEBIAN-CVE-2021-44122Not reported
Debianspipdeb143.2.12-1Not reportedDEBIAN-CVE-2021-44122Not reported
Ubuntuspipdeb18.043.1.4-4~deb9u5build0.18.04.1Not reportedUBUNTU-CVE-2021-44122Not reported
Ubuntuspipdeb20.043.2.7-1ubuntu0.1Not reportedUBUNTU-CVE-2021-44122Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 13 (Trixie)]

  • [spip]Unknown
    Details (9)

    • 4.4.15+dfsg-0+deb13u1 · all · trixie

      Fixed · Fixed: 3.2.12-1

      pypi · spip · debian · 13

    • 4.4.15+dfsg-0+deb13u1 · all · trixie

      Fixed · Fixed: 3.2.12-1

      pypi · spip · debian · 13

    • 4.4.15+dfsg-0+deb13u1 · all · trixie-security · Historical version

      Fixed · Fixed: 3.2.12-1

      pypi · spip · debian · 13

    • 4.4.19+dfsg-0+deb13u1 · all · trixie-security · Historical version

      Fixed · Fixed: 3.2.12-1

      pypi · spip · debian · 13

    • 4.4.20+dfsg-0+deb13u1 · all · trixie-security · Historical version

      Fixed · Fixed: 3.2.12-1

      pypi · spip · debian · 13

    • 4.4.21+dfsg-0+deb13u1 · all · trixie-security · Historical version

      Fixed · Fixed: 3.2.12-1

      pypi · spip · debian · 13

    • 4.4.21+dfsg-0+deb13u1 · all · trixie-security

      Fixed · Fixed: 3.2.12-1

      pypi · spip · debian · 13

    • 4.4.23+dfsg-0+deb13u1 · all · trixie-security · Historical version

      Fixed · Fixed: 3.2.12-1

      pypi · spip · debian · 13

    • 4.4.28+dfsg-0+deb13u1 · all · trixie-security

      Fixed · Fixed: 3.2.12-1

      pypi · spip · debian · 13

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database]