PT-2017-7712 · Joey Hess · Ikiwiki

Intrigeri · Publicado 2017-01-12 · Atualizado 2024-06-15 · CVE-2016-10026

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions ikiwiki version 3.20161219

Description The issue arises from inadequate checking of revision changes to access permissions for a page on sites utilizing the git and recentchanges plugins with the CGI interface enabled. This allows remote attackers to revert specific changes by exploiting permissions to modify the page before the revision was made.

Recommendations For ikiwiki version 3.20161219, consider disabling the CGI interface or restricting access to the git and recentchanges plugins as a temporary workaround until a patch is available.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2016-10026

DLA-812-1

DSA-3760-1

MGASA-2019-0113

OPENSUSE-SU-2024:10860-1

Produtos afetados

Ikiwiki

Referências · 37

• https://suse.com/security/cve/CVE-2019-9187 · Nota
• http://openwall.com/lists/oss-security/2016/12/29/3 · Nota
• https://suse.com/security/cve/CVE-2016-9646 · Nota
• http://openwall.com/lists/oss-security/2016/12/20/7 · Nota
• https://suse.com/security/cve/CVE-2016-1238 · Nota
• https://security-tracker.debian.org/tracker/CVE-2016-10026 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2009-2944 · Nota
• https://suse.com/security/cve/CVE-2008-0169 · Nota
• https://suse.com/security/cve/CVE-2014-1572 · Nota
• https://osv.dev/vulnerability/DSA-3760-1 · Aviso do Fabricante
• https://ikiwiki.info/security/#index46h2 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2016-10026 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-10026 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2016/12/21/3 · Nota
• https://bugs.mageia.org/show_bug.cgi?id=24453 · Nota