PT-2019-5495 · Joey Hess · Ikiwiki

Publicado 2019-02-10 · Atualizado 2024-06-15 · CVE-2019-9187

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions ikiwiki versions prior to 3.20170111.1 ikiwiki versions 3.2018x ikiwiki versions 3.2019x prior to 3.20190228

Description The issue allows for Server-Side Request Forgery (SSRF) via the aggregate plugin, which can also be used to read local files through file: URIs. This can enable a remote attacker to gain unauthorized access to protected information.

Recommendations For versions prior to 3.20170111.1, update to version 3.20170111.1 or later. For versions 3.2018x, consider disabling the aggregate plugin until a patch is available. For versions 3.2019x prior to 3.20190228, update to version 3.20190228 or later. As a temporary workaround, consider restricting access to the aggregate plugin to minimize the risk of exploitation.

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

BDU:2020-03290

CVE-2019-9187

DLA-1716-1

DSA-4399-1

MGASA-2019-0113

OPENSUSE-SU-2024:10860-1

Produtos afetados

Ikiwiki

Referências · 41

• https://ikiwiki.info/news · Aviso do Fabricante
• http://source.ikiwiki.branchable.com/?p=source.git;a=commitdiff;h=d283e4c · Nota
• https://suse.com/security/cve/CVE-2016-9646 · Nota
• https://suse.com/security/cve/CVE-2009-2944 · Nota
• https://suse.com/security/cve/CVE-2008-0169 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-9187 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2019-9187 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=24453 · Nota
• https://openwall.com/lists/oss-security/2016/05/06/9 · Nota
• https://suse.com/security/cve/CVE-2011-1401 · Nota
• http://source.ikiwiki.branchable.com/?p=source.git;a=commitdiff;h=e7b0d4a · Nota
• https://debian.org/security/2019/dsa-4399 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2011-0428 · Nota
• https://ikiwiki.info/news/version_3.20190228 · Nota
• https://openwall.com/lists/oss-security/2017/01/12/2 · Nota