SPIP Cross-Site Scripting Vulnerability in Public Area

A cross-site scripting (XSS) vulnerability has been identified in SPIP versions prior to 4.4.8. This issue arises in the public area under certain edge-case usage patterns, where the 'echapper_html_suspect()' function fails to properly detect all forms of malicious content. As a result, an attacker can inject scripts that execute in the browser of a visitor. Notably, this vulnerability is not addressed by SPIP's security screen.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where injected scripts are executed in the context of the user's browser.

Remediation

Users can update to SPIP version 4.4.8, which includes a fix for this vulnerability. Instructions for updating are available on the SPIP website.