The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthenticated attacker can execute arbitrary PHP as the SPIP user by sending a crafted HTTP request.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary     code execution vulnerability. A remote and unauthenticated attacker can execute arbitrary PHP as the SPIP     user by sending a crafted HTTP request. (CVE-2024-7954)

Note that Nessus relies on the presence of the package as reported by the vendor.

The SPIP CMS versions prior to 4.1.16 or 4.2.x prior to 4.2.13 or 4.3.x prior to 4.3.0-alpha2 are vulnerable to an unauthenticated Remote Code Execution through the 'porte_plume' plugin by sending a specially forged HTTP request.

ID	Name	Product	Family	Severity
257057	Linux Distros Unpatched Vulnerability : CVE-2024-7954	Nessus	Misc.	critical
114660	SPIP CMS < 4.1.16 / 4.2.x < 4.2.13 / 4.3.x < 4.3.0-alpha2 Remote Code Execution	Web App Scanning	Component Vulnerability	critical

Detections

Analytics

CVE-2024-7954

critical

Tenable Plugins

critical

critical