SPIP Cross-Site Scripting Vulnerability in Code Tags

A cross-site scripting (XSS) vulnerability has been identified in SPIP versions prior to 4.2.15. The issue arises because the application fails to properly sanitize JavaScript embedded within HTML code tags. This oversight enables attackers to inject malicious scripts that can be executed in the context of the victim's browser.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where injected scripts are executed in the context of the user's browser, potentially leading to session hijacking or other malicious actions.

Remediation

Users can update to SPIP version 4.2.15 or later to address this vulnerability. The update can be downloaded from the SPIP official website or via the SPIP loader.