CVE-2023-27372
CRITICAL 9.8EPSS 99.7%
SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1.
- CVSS v3.1 NVD
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- 99.68% chance of exploitation in the next 30 days, 100th percentile
- Nuclei
- critical
- Published
- 2023-02-28
- Updated
- 2025-03-11
Proof-of-concept exploits (17)
- 0SPwn/CVE-2023-27372-PoC6★ · 2023-07-05
- 1Ronkkeli/spip-cve-2023-27372-rce2★ · 2025-04-28
- 1amthebest1/CVE-2023-273720★ · 2024-08-15
- Chocapikk/CVE-2023-273729★ · 2023-09-16
- G01d3nW01f/cve-2023-273720★ · 2025-07-25
- Jhonsonwannaa/CVE-2023-273720★ · 2025-02-23
- Pari-Malam/CVE-2023-273723★ · 2023-07-31
- RSTG0D/CVE-2023-27372-PoC6★ · 2023-07-05
- ThatNotEasy/CVE-2023-273723★ · 2023-07-31
- dream434/CVE-2023-273720★ · 2025-02-23
- izzz0/CVE-2023-27372-POC2★ · 2023-07-12
- nuts7/CVE-2023-2737268★ · 2024-10-13
- redboltsec/CVE-2023-27372-PoC0★ · 2023-09-07
- Ap0dexMe0/CVE-2023-273723★ · 2023-07-31
- KirolosKhairy/CVE-2023-273720★ · 2026-01-28
- estebanzarate/CVE-2023-27372-SPIP-4.2.1-Unauthenticated-RCE-PoC1★ · 2026-02-24
- scriniariii/CVE-2023-273720★ · 2026-03-30
Nuclei templates (1)
Metasploit modules (1)
ExploitDB entries (1)
Exploit collections (1)
- CVE-2023-27372.yamlzan8in/afrog
Security advisories
- https://www.debian.org/security/2023/dsa-5367
- https://git.spip.net/spip/spip/commit/5aedf49b89415a4df3eb775eee3801a2b4b88266
- https://git.spip.net/spip/spip/commit/96fbeb38711c6706e62457f2b732a652a04a409d
- https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-2-1-SPIP-4-1-8-SP…