PT-2018-17937 · Tiki · Tiki

Lfagundes · Publicado 2018-02-16 · Atualizado 2018-03-13 · CVE-2018-7188

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Tiki versions prior to 18

Description The issue allows an authenticated user to gain administrator privileges by exploiting an XSS vulnerability via an SVG image. This occurs when an administrator opens a wiki page containing a malicious SVG image, related to the file lib/filegals/filegallib.php.

Recommendations For versions prior to 18, update to version 18 or later to resolve the issue. As a temporary workaround, consider restricting access to wiki pages that may contain malicious SVG images until the update is applied.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-7188

Produtos afetados

Tiki

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-7188 · Nota de Segurança
• http://openwall.com/lists/oss-security/2018/02/16/1 · Nota
• https://sourceforge.net/p/tikiwiki/code/65327 · Correção
• https://osv.dev/vulnerability/CVE-2018-7188 · Aviso do Fabricante