{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SPIP versions 2.1.x ant\u00e9rieures \u00e0 2.1.12.",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    },
    {
      "description": "SPIP versions 1.9.x ant\u00e9rieures \u00e0 1.9.2n ;",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    },
    {
      "description": "SPIP versions 2.0.x ant\u00e9rieures \u00e0 2.0.17 ;",
      "product": {
        "name": "SPIP",
        "vendor": {
          "name": "SPIP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nPlusieurs vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans SPIP :\n\n-   un utilisateur authentifi\u00e9 peut \u00e9lever ses privil\u00e8ges au sein de\n    SPIP et en devenir administrateur ;\n-   il est possible d\u0027afficher le chemin d\u0027installation ;\n-   une injection de code indirecte \u00e0 distance est r\u00e9alisable.\n\n## Solution\n\nLes versions 1.9.2n, 2.0.17 et 2.1.12 corrigent ces vuln\u00e9rabilit\u00e9s. La\nmise \u00e0 jour de l\u0027\u00e9cran de s\u00e9curit\u00e9 (derni\u00e8re version en date du 5\nnovembre 2011) est recommand\u00e9e mais ne suffit pas pour les branches 2.0\net 2.1.\n",
  "cves": [],
  "initial_release_date": "2011-11-21T00:00:00",
  "last_revision_date": "2011-11-21T00:00:00",
  "links": [],
  "reference": "CERTA-2011-AVI-654",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2011-11-21T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "Des vuln\u00e9rabilit\u00e9s dans \u003cspan class=\"textit\"\u003eSPIP\u003c/span\u003e permettent une\n\u00e9l\u00e9vation de privil\u00e8ges dans l\u0027application et une injection de code\nindirecte \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9s dans SPIP",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Annonce de SPIP du 17 novembre 2011",
      "url": "http://archives.rezo.net/archives/spip-ann.mbox/2011/11/"
    }
  ]
}