Back to Database
Status published
Unknown
CVE-2022-37155
RCE in SPIP 3.1.13 through 4.1.2 allows remote authenticated users...
Vulnerability Description
RCE in SPIP 3.1.13 through 4.1.2 allows remote authenticated users to execute arbitrary code via the _oups parameter.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-37155
Credits & Attribution
No credits recorded in the NVD database.
References
- https://spawnzii.github.io/posts/2022/07/how-we-have-pwned-root-me-in-2022/
- https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-1-5-SPIP-4-0-8-et-SPIP-3-2-16.html
- https://pastebin.com/ZH7CPc8X
- https://github.com/Abyss-W4tcher/ab4yss-wr4iteups/blob/ffa980faa9e3598d49d6fb7def4f7a67cfb5f427/SPIP%20-%20Pentest/SPIP%204.1.2/SPIP_4.1.2_AUTH_RCE/SPIP_4.1.2_AUTH_RCE_Abyss_Watcher_12_07_22.md
More from spip
View All →CVE-2023-53900
Spip 4.1.10 Admin Account Spoofing via Malicious SVG Upload
Medium
4.8
CVE-2022-28961
Spip Web Framework v3.1.13 and below was discovered to contain...
High
8.8
CVE-2022-28960
A PHP injection vulnerability in Spip before v3.2.8 allows attackers...
High
8.8
CVE-2022-28959
Multiple cross-site scripting (XSS) vulnerabilities in the component /spip.php of...
Medium
6.1
CVE-2022-26847
SPIP before 3.2.14 and 4.x before 4.0.5 allows unauthenticated access...
Medium
5.3
Affected Vendor
spip
View all reports →Affected Software
spip
Vulnerable Versions:
3.1.13
Timeline
Official Publish:
December 13th, 2022
Last Modified:
April 22nd, 2025
Added to House:
July 21st, 2026
CVSS Vectors
No vector data available
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.