CVE-2016-7999

High

Published: 18/01/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The valider_xml.php file in SPIP version 3.1.2 and earlier allows remote attackers to conduct server side request forgery (SSRF) attacks via a URL in the var_url parameter in a valider_xml action.

Risk Assessment

SSRF attacks can lead to unauthorized access to internal server resources, posing a significant security threat to the organization.

Recommendation

It is recommended to update SPIP to the latest version to mitigate the risk associated with this vulnerability.

Other vulnerabilities in SPIP 3.1.2 and earlier

CVE-2016-7982High
Directory traversal vulnerability in valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to enumerate files on the system via the var_url parameter in a valider_xml action.

Original NVD description (English source)

ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to conduct server side request forgery (SSRF) attacks via a URL in the var_url parameter in a valider_xml action.