CVE-2021-44123: Unrestricted Upload of File with Dangerous Type

January 26, 2022 (updated February 2, 2022)

SPIP is affected by a remote command execution vulnerability. To exploit the vulnerability, an attacker must craft a malicious picture with a double extension, upload it and then click on it to execute it.

References

git.spip.net/spip/spip/commit/1cf91def15966406ddd0488cf9d1ecd1ae82d47a
nvd.nist.gov/vuln/detail/CVE-2021-44123

Code Behaviors & Features

Detect and mitigate CVE-2021-44123 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →