CVE-2013-7303 : Multiple cross-site scripting (XSS) vulnerabilities in (1) squelettes-dist/formu

Multiple cross-site scripting (XSS) vulnerabilities in (1) squelettes-dist/formulaires/inscription.php and (2) prive/forms/editer_auteur.php in SPIP before 2.1.25 and 3.0.x before 3.0.13 allow remote attackers to inject arbitrary web script or HTML via the author name field.

Published 2014-01-30 21:55:05

Updated 2017-08-29 01:34:07

Source Debian GNU/Linux

View at NVD, CVE.org

Vulnerability category: Cross site scripting (XSS)

Products affected by CVE-2013-7303

Spip » Spip
Versions up to, including, (<=) 2.1.24
cpe:2.3:a:spip:spip:*:*:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 2.0.1
cpe:2.3:a:spip:spip:2.0.1:*:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 2.0.7
cpe:2.3:a:spip:spip:2.0.7:*:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 2.0.2
cpe:2.3:a:spip:spip:2.0.2:*:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 2.0.8
cpe:2.3:a:spip:spip:2.0.8:*:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 2.0.6
cpe:2.3:a:spip:spip:2.0.6:*:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 2.0.5
cpe:2.3:a:spip:spip:2.0.5:*:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 2.0.4
cpe:2.3:a:spip:spip:2.0.4:*:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 2.0.3
cpe:2.3:a:spip:spip:2.0.3:*:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 2.1
cpe:2.3:a:spip:spip:2.1:*:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 3.0.1
cpe:2.3:a:spip:spip:3.0.1:*:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 3.0.2
cpe:2.3:a:spip:spip:3.0.2:*:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 3.0.3
cpe:2.3:a:spip:spip:3.0.3:*:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 3.0.4
cpe:2.3:a:spip:spip:3.0.4:*:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 3.0.0
cpe:2.3:a:spip:spip:3.0.0:*:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 3.0.5
cpe:2.3:a:spip:spip:3.0.5:*:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 3.0.7
cpe:2.3:a:spip:spip:3.0.7:*:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 3.0.6
cpe:2.3:a:spip:spip:3.0.6:*:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 3.0.8
cpe:2.3:a:spip:spip:3.0.8:*:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 2.1.1
cpe:2.3:a:spip:spip:2.1.1:*:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 2.1.2
cpe:2.3:a:spip:spip:2.1.2:*:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 2.1.17
cpe:2.3:a:spip:spip:2.1.17:*:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 2.1.18
cpe:2.3:a:spip:spip:2.1.18:*:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 2.1.19
cpe:2.3:a:spip:spip:2.1.19:*:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 2.1.20
cpe:2.3:a:spip:spip:2.1.20:*:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 2.1.10
cpe:2.3:a:spip:spip:2.1.10:*:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 2.1.11
cpe:2.3:a:spip:spip:2.1.11:*:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 2.1.12
cpe:2.3:a:spip:spip:2.1.12:*:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 2.1.14
cpe:2.3:a:spip:spip:2.1.14:*:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 2.1.16
cpe:2.3:a:spip:spip:2.1.16:*:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 2.1.21
cpe:2.3:a:spip:spip:2.1.21:*:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 2.1.13
cpe:2.3:a:spip:spip:2.1.13:*:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 2.1.15
cpe:2.3:a:spip:spip:2.1.15:*:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 2.0.11
cpe:2.3:a:spip:spip:2.0.11:*:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 2.0.12
cpe:2.3:a:spip:spip:2.0.12:*:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 2.0.13
cpe:2.3:a:spip:spip:2.0.13:*:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 2.0.14
cpe:2.3:a:spip:spip:2.0.14:*:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 2.0.19
cpe:2.3:a:spip:spip:2.0.19:*:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 2.0.20
cpe:2.3:a:spip:spip:2.0.20:*:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 2.0.21
cpe:2.3:a:spip:spip:2.0.21:*:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 2.0.22
cpe:2.3:a:spip:spip:2.0.22:*:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 2.0.9
cpe:2.3:a:spip:spip:2.0.9:*:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 2.0.16
cpe:2.3:a:spip:spip:2.0.16:*:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 2.0.18
cpe:2.3:a:spip:spip:2.0.18:*:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 2.0.10
cpe:2.3:a:spip:spip:2.0.10:*:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 2.0.15
cpe:2.3:a:spip:spip:2.0.15:*:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 2.0.17
cpe:2.3:a:spip:spip:2.0.17:*:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 2.1.22
cpe:2.3:a:spip:spip:2.1.22:*:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 3.0.9
cpe:2.3:a:spip:spip:3.0.9:*:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 3.0.10
cpe:2.3:a:spip:spip:3.0.10:*:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 3.0.11
cpe:2.3:a:spip:spip:3.0.11:*:*:*:*:*:*:*
Matching versions
Spip » Spip » Version: 2.1.23
cpe:2.3:a:spip:spip:2.1.23:*:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2013-7303

Top countries where our scanners detected CVE-2013-7303

Top open port discovered on systems with this issue 80

IPs affected by CVE-2013-7303 13

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2013-7303!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2013-7303

EPSS FAQ

0.31%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 66 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2013-7303

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None

CWE ids for CVE-2013-7303

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2013-7303

http://www.spip.net/fr_article5648.html

Changements entre 3.0.11 et 3.0.13 - SPIP

CVEs referencing this url
http://seclists.org/oss-sec/2014/q1/123

oss-sec: CVE request: spip: cross-site scripting vulnerability
http://www.securitytracker.com/id/1029703

SPIP Input Validation Flaw in Author Name Field Permits Cross-Site Scripting Attacks - SecurityTracker
http://www.spip.net/fr_article5665.html

Changements entre 2.1.24 et 2.1.25 - SPIP
http://seclists.org/oss-sec/2014/q1/128

oss-sec: Re: CVE request: spip: cross-site scripting vulnerability
http://core.spip.org/projects/spip/repository/revisions/20902

Revision 20902 - ecrire/inc/filtres.php, prive/formulaires/editer_auteur.php : éviter un xss s... - SPIP - SPIP Core (Forge de développement)
https://exchange.xforce.ibmcloud.com/vulnerabilities/90643

SPIP author name cross-site scripting CVE-2013-7303 Vulnerability Report
http://zone.spip.org/trac/spip-zone/changeset/77768