Dismissed
Permalink
CVE-2025-71244
6.1 MEDIUM
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): LOW
- Privileges required (PR): NONE
- User interaction (UI): REQUIRED
- Scope (S): CHANGED
- Confidentiality impact (C): LOW
- Integrity impact (I): LOW
- Availability impact (A): NONE
by @LeSuisse Activity log
- Created automatic suggestion
-
@LeSuisse
removed
4 packages
- spip
- spiped
- aespipe
- lesspipe
- @LeSuisse dismissed
SPIP < 4.4.5 Open Redirect via Login Form
SPIP before 4.4.5 and 4.3.9 allows an Open Redirect via the login form when used in AJAX mode. An attacker can craft a malicious URL that, when visited by a victim, redirects them to an arbitrary external site after login. This vulnerability only affects sites where the login page has been overridden to function in AJAX mode. It is not mitigated by the SPIP security screen.
References
- https://git.spip.net/spip/spip product
- VulnCheck Advisory: SPIP < 4.4.5 Open Redirect via Login Form third-party-advisory
- https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-5.html vendor-advisory patch
Affected products
SPIP
- <4.4.5
- <4.3.9
Ignored packages (4)
pkgs.spip
A random forest model for splice prediction in genomics
-
nixos-unstable 0-unstable-2023-04-19
- nixpkgs-unstable 0-unstable-2023-04-19
- nixos-unstable-small 0-unstable-2023-04-19
-
nixos-25.11 0-unstable-2023-04-19
- nixos-25.11-small 0-unstable-2023-04-19
- nixpkgs-25.11-darwin 0-unstable-2023-04-19
pkgs.spiped
Utility for secure encrypted channels between sockets
pkgs.aespipe
AES encrypting or decrypting pipe