CVE-2019-16392

SPIP versiones anteriores a 3.1.11 y versiones 3.2 anteriores a 3.2.5, permite un ataque de tipo XSS del archivo prive/formulaires/login.php por medio de mensajes de error.

Youssouf Boulouiz discovered that SPIP incorrectly handled login error messages. A remote attacker could potentially exploit this to conduct cross-site scripting attacks. Gilles Vincent discovered that SPIP incorrectly handled password reset requests. A remote attacker could possibly use this issue to cause SPIP to enumerate registered users. Guillaume Fahrner discovered that SPIP did not properly sanitize input. A remote authenticated attacker could possibly use this issue to execute arbitrary code on the host server. Various other issues were also addressed.