Critical SPIP Vulnerabilities Discovered in Ubuntu 16.04 LTS

Severity: High (Score: 72.5)

Sources: Linuxsecurity, Ubuntu

Summary

Multiple vulnerabilities have been identified in the SPIP website engine affecting Ubuntu 16.04 LTS and its derivatives. These vulnerabilities include cross site scripting (CVE-2022-28959), PHP injection (CVE-2022-28960), and SQL injection (CVE-2022-28961), all resulting from improper input sanitization. A remote attacker could exploit these issues to execute malicious scripts or commands on affected systems. The vulnerabilities were published on May 19, 2022, and have been addressed in recent updates. Users are advised to update their systems to the latest package versions to mitigate these risks. Ubuntu Pro users can benefit from extended security maintenance for these packages. The vulnerabilities pose a significant risk, particularly for web applications utilizing SPIP. Immediate action is recommended to prevent potential exploitation. Key Points: • SPIP vulnerabilities allow for XSS, PHP injection, and SQL injection attacks. • Affected systems include Ubuntu 16.04 LTS and its derivatives. • Users should update to the latest package versions to mitigate risks.

Key Entities

• Cross-site Scripting (attack_type)
• Sql Injection (attack_type)
• XSS (vulnerability)
• CVE-2022-28959 (cve)
• CVE-2022-28960 (cve)
• CVE-2022-28961 (cve)
• SPIP (platform)
• Ubuntu 16.04 LTS (platform)
• Ubuntu Pro (platform)
• Ubuntu (company)