CVE-2025-71244

MEDIUM

6.1

Descricao

SPIP before 4.4.5 and 4.3.9 allows an Open Redirect via the login form when used in AJAX mode. An attacker can craft a malicious URL that, when visited by a victim, redirects them to an arbitrary external site after login. This vulnerability only affects sites where the login page has been overridden to function in AJAX mode. It is not mitigated by the SPIP security screen.

Detalhes CVE

Pontuacao CVSS v3.16.1

SeveridadeMEDIUM

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosNONE

Interacao do usuarioREQUIRED

Publicado2/19/2026

Ultima modificacao2/24/2026

Fontenvd

Avistamentos honeypot0

Produtos afetados

spip:spip

Fraquezas (CWE)

CWE-601

Referencias

https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-5.html(disclosure@vulncheck.com)

https://git.spip.net/spip/spip(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/spip-open-redirect-via-login-form(disclosure@vulncheck.com)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.