{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SPIP versions 2.0 ant\u00e9rieures \u00e0 2.0.16 ;",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    },
    {
      "description": "SPIP versions 2.1 ant\u00e9rieures \u00e0 2.1.11.",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    },
    {
      "description": "SPIP versions 1.9.2 ant\u00e9rieures \u00e0 1.9.2k ;",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nPlusieurs vuln\u00e9rabilit\u00e9s, non d\u00e9taill\u00e9es par l\u0027\u00e9diteur, ont \u00e9t\u00e9\nd\u00e9couvertes dans SPIP. Elles permettent de r\u00e9aliser des injections SQL\n(versions 1.9.2 uniquement), et d\u0027obtenir le chemin complet\nd\u0027installation du logiciel (versions 2.0 et 2.1). \u00c0 noter que d\u00e8s la\nsortie de la version 3.0 de SPIP, la branche 1.9.2 ne sera plus\nmaintenue.\n\n## Solution\n\nMettre SPIP \u00e0 jour en version 1.9.2k, 2.0.16 ou 2.1.11.\n",
  "cves": [],
  "initial_release_date": "2011-09-23T00:00:00",
  "last_revision_date": "2011-09-23T00:00:00",
  "links": [
    {
      "title": "Page de t\u00e9l\u00e9chargement de SPIP :",
      "url": "http://www.spip.net/fr_download"
    }
  ],
  "reference": "CERTA-2011-AVI-533",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2011-09-23T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection SQL"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "Plusieurs vuln\u00e9rabilit\u00e9s dans \u003cspan class=\"textit\"\u003eSPIP\u003c/span\u003e\npermettent de r\u00e9aliser des injections SQL et d\u0027obtenir des informations\nsur le chemin d\u0027installation.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans SPIP",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Message des d\u00e9veloppeurs de SPIP du 23 septembre 2011 dans leur liste de diffusion",
      "url": null
    }
  ]
}