SPIP < 4.3.6 Authorization Bypass Leading to Content Disclos…(CVE-2025-71242)

概要

SPIP < 4.3.6 Authorization Bypass Leading to Content Disclosure

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

SPIP before 4.3.6, 4.2.17, and 4.1.20 allows unauthorized content disclosure in the private area. The application does not properly check authorization when displaying content of articles and sections (rubriques) in AJAX-loaded fragments, allowing an authenticated attacker to access restricted content. This vulnerability is not mitigated by the SPIP security screen.

出典: OSV.dev (Open Source Vulnerabilities) NVD OSV

ディストリビューション別の修正状況

各ディストリビューションが公開している、この CVE の修正パッケージ

Debian DEBIAN-CVE-2025-71242 spip

参照URL

advisory github.com
advisory nvd.nist.gov
advisory vulncheck.com
patch blog.spip.net
web git.spip.net