| Package | Affected versions | Patched versions |
|---|---|---|
| spip | ≥ 4.4.0, < 4.4.8 | 4.4.8 |
SPIP before 4.4.8 allows cross-site scripting (XSS) in the private area via malicious iframe tags. The application does not properly sandbox or escape iframe content in the back-office, allowing an attacker to inject and execute malicious scripts. The fix adds a sandbox attribute to iframe tags in the private area. This vulnerability is not mitigated by the SPIP security screen.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free