CVE-2020-28984: 
NixOS vulnerability analysis and mitigation

CVE-2020-28984 affects SPIP, a website engine for publishing, before version 3.2.8. The vulnerability was discovered in November 2020 and involves improper validation of several parameters including couleur, display, display_navigation, display_outils, imessage, and spip_ecran in the prive/formulaires/configurer_preferences.php file (NVD, Debian Security).

The vulnerability stems from insufficient input validation in the prive/formulaires/configurer_preferences.php file. The affected parameters include couleur, display, display_navigation, display_outils, imessage, and spip_ecran. The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (Critical), with attack vector being Network, attack complexity Low, and requiring no privileges or user interaction (Ubuntu Security).

If exploited, this vulnerability allows authenticated users to execute arbitrary code on the affected system. The vulnerability affects the confidentiality, integrity, and availability of the system, all rated as High impact according to the CVSS scoring (Ubuntu Security).

The vulnerability requires authentication to exploit, but has low attack complexity and requires no user interaction. The attack vector is accessible through the network, making it potentially exploitable remotely by authenticated users (Ubuntu Security).

The vulnerability has been fixed in SPIP version 3.2.8 and later. For Debian systems, fixes have been released in version 3.2.4-1+deb10u3 for Debian 10 (buster) and version 3.1.4-4~deb9u4 for Debian 9 (stretch). Users are recommended to upgrade their SPIP packages to these patched versions (Debian Security, Debian LTS).