CVE-2019-16391

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

SPIP before 3.1.11 and 3.2 before 3.2.5 allows authenticated visitors to modify any published content and execute other modifications in the database. This is related to ecrire/inc/meta.php and ecrire/inc/securiser_action.php.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://blog.spip.net/Mise-a-jour-CRITIQUE-de-securite-Sortie-de-SPIP-3-2-5-et-SPIP-3-1-11.htmlPatch, Vendor Advisory
https://blog.spip.net/Mise-a-jour-CRITIQUE-de-securite-Sortie-de-SPIP-3-2-5-et-SPIP-3-1-11.html?lang=frPatch, Vendor Advisory
https://git.spip.net/SPIP/spip/commit/187952ce85e73b52c2753f2d54fc2c44807b8f79Patch, Vendor Advisory
https://git.spip.net/SPIP/spip/commit/3cbc758400323ab006c00ea78eacdb8f76aa5f66Patch, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2019/10/msg00038.htmlMailing List, Third Party Advisory
https://seclists.org/bugtraq/2019/Sep/40Mailing List, Third Party Advisory
https://usn.ubuntu.com/4536-1/Third Party Advisory
https://www.debian.org/security/2019/dsa-4532Third Party Advisory
https://blog.spip.net/Mise-a-jour-CRITIQUE-de-securite-Sortie-de-SPIP-3-2-5-et-SPIP-3-1-11.htmlPatch, Vendor Advisory
https://blog.spip.net/Mise-a-jour-CRITIQUE-de-securite-Sortie-de-SPIP-3-2-5-et-SPIP-3-1-11.html?lang=frPatch, Vendor Advisory
https://git.spip.net/SPIP/spip/commit/187952ce85e73b52c2753f2d54fc2c44807b8f79Patch, Vendor Advisory
https://git.spip.net/SPIP/spip/commit/3cbc758400323ab006c00ea78eacdb8f76aa5f66Patch, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2019/10/msg00038.htmlMailing List, Third Party Advisory
https://seclists.org/bugtraq/2019/Sep/40Mailing List, Third Party Advisory
https://usn.ubuntu.com/4536-1/Third Party Advisory
https://www.debian.org/security/2019/dsa-4532Third Party Advisory

Timeline

Published: Sep 17, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-163926.1SPIP before 3.1.11 and 3.2 before 3.2.5 allows prive/formulaires/login.php XSS via error messages.CVE-2019-163936.1SPIP before 3.1.11 and 3.2 before 3.2.5 mishandles redirect URLs in ecrire/inc/headers.php with a %0D, %0A, or %20 character.CVE-2019-163945.3SPIP before 3.1.11 and 3.2 before 3.2.5 provides different error messages from the password-reminder page depending on whether an e-mail add CVE-2019-163957.8GnuCOBOL 2.2 has a stack-based buffer overflow in the cb_name() function in cobc/tree.c via crafted COBOL source code.CVE-2019-163967.8GnuCOBOL 2.2 has a use-after-free in the end_scope_of_program_name() function in cobc/parser.y via crafted COBOL source code.CVE-2019-163986.8On Keeper K5 20.1.0.25 and 20.1.0.63 devices, remote code execution can occur by inserting an SD card containing a file named zskj_script_ru CVE-2019-163999.8Western Digital WD My Book World through II 1.02.12 suffers from Broken Authentication, which allows an attacker to access the /admin/ direc CVE-2019-16407.8A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could all CVE-2019-164006.5Samsung Galaxy S8 plus (Android version: 8.0.0, Build Number: R16NW.G955USQU5CRG3, Baseband Vendor: Qualcomm Snapdragon 835, Baseband: G955U CVE-2019-164016.5Samsung Galaxy S8 plus (Android version: 8.0.0, Build Number: R16NW.G955USQU5CRG3, Baseband Vendor: Qualcomm Snapdragon 835, Baseband: G955U CVE-2019-164038.8In Webkul Bagisto before 0.1.5, the functionalities for customers to change their own values (such as address, review, orders, etc.) can als CVE-2019-164048.8Authenticated SQL Injection in interface/forms/eye_mag/js/eye_base.php in OpenEMR through 5.0.2 allows a user to extract arbitrary data from