CVE-2013-4555

medium
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

Cross-site request forgery (CSRF) vulnerability in ecrire/action/logout.php in SPIP before 2.1.24 allows remote attackers to hijack the authentication of arbitrary users for requests that logout the user via unspecified vectors.

References

http://core.spip.org/projects/spip/repository/revisions/20874

http://secunia.com/advisories/55551

http://www.openwall.com/lists/oss-security/2013/11/10/4

http://www.securitytracker.com/id/1029317

http://www.spip.net/fr_article5646.html

https://www.debian.org/security/2013/dsa-2794

Details

Source: MITRE

Published: 2013-11-18

Updated: 2016-12-08

Type: CWE-352

Risk Information

CVSS v2

Base Score: 6.8

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Impact Score: 6.4

Exploitability Score: 8.6

Severity: MEDIUM

Vulnerable Software

Configuration 1

OR

cpe:2.3:a:spip:spip:2.0.0:*:*:*:*:*:*:*

cpe:2.3:a:spip:spip:2.0.1:*:*:*:*:*:*:*

cpe:2.3:a:spip:spip:2.0.2:*:*:*:*:*:*:*

cpe:2.3:a:spip:spip:2.0.3:*:*:*:*:*:*:*

cpe:2.3:a:spip:spip:2.0.4:*:*:*:*:*:*:*

cpe:2.3:a:spip:spip:2.0.5:*:*:*:*:*:*:*

cpe:2.3:a:spip:spip:2.0.6:*:*:*:*:*:*:*

cpe:2.3:a:spip:spip:2.0.7:*:*:*:*:*:*:*

cpe:2.3:a:spip:spip:2.0.8:*:*:*:*:*:*:*

cpe:2.3:a:spip:spip:2.0.9:*:*:*:*:*:*:*

cpe:2.3:a:spip:spip:2.0.10:*:*:*:*:*:*:*

cpe:2.3:a:spip:spip:2.0.11:*:*:*:*:*:*:*

cpe:2.3:a:spip:spip:2.0.12:*:*:*:*:*:*:*

cpe:2.3:a:spip:spip:2.0.13:*:*:*:*:*:*:*

cpe:2.3:a:spip:spip:2.0.14:*:*:*:*:*:*:*

cpe:2.3:a:spip:spip:2.0.15:*:*:*:*:*:*:*

cpe:2.3:a:spip:spip:2.0.16:*:*:*:*:*:*:*

cpe:2.3:a:spip:spip:2.0.17:*:*:*:*:*:*:*

cpe:2.3:a:spip:spip:2.0.18:*:*:*:*:*:*:*

cpe:2.3:a:spip:spip:2.0.19:*:*:*:*:*:*:*

cpe:2.3:a:spip:spip:2.0.20:*:*:*:*:*:*:*

cpe:2.3:a:spip:spip:2.0.21:*:*:*:*:*:*:*

cpe:2.3:a:spip:spip:2.0.22:*:*:*:*:*:*:*

cpe:2.3:a:spip:spip:2.1.1:*:*:*:*:*:*:*

cpe:2.3:a:spip:spip:2.1.2:*:*:*:*:*:*:*

cpe:2.3:a:spip:spip:2.1.3:*:*:*:*:*:*:*

cpe:2.3:a:spip:spip:2.1.4:*:*:*:*:*:*:*

cpe:2.3:a:spip:spip:2.1.5:*:*:*:*:*:*:*

cpe:2.3:a:spip:spip:2.1.6:*:*:*:*:*:*:*

cpe:2.3:a:spip:spip:2.1.7:*:*:*:*:*:*:*

cpe:2.3:a:spip:spip:2.1.8:*:*:*:*:*:*:*

cpe:2.3:a:spip:spip:2.1.9:*:*:*:*:*:*:*

cpe:2.3:a:spip:spip:2.1.10:*:*:*:*:*:*:*

cpe:2.3:a:spip:spip:2.1.11:*:*:*:*:*:*:*

cpe:2.3:a:spip:spip:2.1.12:*:*:*:*:*:*:*

cpe:2.3:a:spip:spip:2.1.13:*:*:*:*:*:*:*

cpe:2.3:a:spip:spip:2.1.14:*:*:*:*:*:*:*

cpe:2.3:a:spip:spip:2.1.15:*:*:*:*:*:*:*

cpe:2.3:a:spip:spip:2.1.16:*:*:*:*:*:*:*

cpe:2.3:a:spip:spip:2.1.17:*:*:*:*:*:*:*

cpe:2.3:a:spip:spip:2.1.18:*:*:*:*:*:*:*

cpe:2.3:a:spip:spip:2.1.19:*:*:*:*:*:*:*

cpe:2.3:a:spip:spip:2.1.20:*:*:*:*:*:*:*

cpe:2.3:a:spip:spip:2.1.21:*:*:*:*:*:*:*

cpe:2.3:a:spip:spip:2.1.22:*:*:*:*:*:*:*

cpe:2.3:a:spip:spip:*:*:*:*:*:*:*:* versions up to 2.1.23 (inclusive)

Tenable Plugins

View all (1 total)

IDNameProductFamilySeverity
70981Debian DSA-2794-1 : spip - several vulnerabilitiesNessusDebian Local Security Checks
high