DEBIAN-CVE-2009-3041

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2009-3041
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2009-3041.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2009-3041
Upstream
Published
2009-09-01T18:30:04.920Z
Modified
2026-05-29T06:00:07.045495699Z
Summary
[none]
Details

SPIP 1.9 before 1.9.2i and 2.0.x through 2.0.8 does not use proper access control for (1) ecrire/exec/install.php and (2) ecrire/index.php, which allows remote attackers to conduct unauthorized activities related to installation and backups, as exploited in the wild in August 2009.

References

Affected packages

Debian:11 / spip

Package

Name
spip
Purl
pkg:deb/debian/spip?arch=source&distro=bullseye

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.0.9-1

Ecosystem specific 

{
    "urgency": "medium"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2009-3041.json"

Debian:13 / spip

Package

Name
spip
Purl
pkg:deb/debian/spip?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.0.9-1

Ecosystem specific 

{
    "urgency": "medium"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2009-3041.json"

Debian:14 / spip

Package

Name
spip
Purl
pkg:deb/debian/spip?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.0.9-1

Ecosystem specific 

{
    "urgency": "medium"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2009-3041.json"