SPIP 'logout.php' CVE-2013-4555 Cross Site Request Forgery Vulnerability

Bugtraq ID:	63638
Class:	Input Validation Error
CVE:	CVE-2013-4555
Remote:	Yes
Local:	No
Published:	Nov 11 2013 12:00AM
Updated:	Nov 13 2013 12:53AM
Credit:	Salvatore Bonaccorso
Vulnerable:	Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:

SPIP 'logout.php' CVE-2013-4555 Cross Site Request Forgery Vulnerability

SPIP is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible.

Versions prior to SPIP 2.1.24 are vulnerable.

SPIP 'logout.php' CVE-2013-4555 Cross Site Request Forgery Vulnerability

Attackers can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

SPIP 'logout.php' CVE-2013-4555 Cross Site Request Forgery Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

SPIP 'logout.php' CVE-2013-4555 Cross Site Request Forgery Vulnerability

References:

• SPIP Homepage (SPIP)