PT-2010-2082 · Dokuwiki · Dokuwiki

Published 2010-02-15 · Updated 2019-09-23 · CVE-2010-0288

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions DokuWiki versions prior to 2009-12-25b

Description A typo in the administrator permission check in the ACL Manager plugin allows remote attackers to gain privileges and access closed wikis by editing current ACL statements. This issue has been exploited in the wild.

Recommendations For versions prior to 2009-12-25b, update to a version that includes the fix for the administrator permission check in the ACL Manager plugin. As a temporary workaround, consider restricting access to the ACL Manager plugin to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2010-0288

DSA-1976-1

Affected Products

Dokuwiki

References · 21

• 🔥 https://exploit-db.com/exploits/11141 · Exploit
• 🔥 http://exploit-db.com/exploits/11141 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2010-0288 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-0288 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2010-February/034831.html · Vendor Advisory
• http://secunia.com/advisories/38183 · Vendor Advisory
• https://ubuntu.com/security/CVE-2010-0288 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-0288 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2010-February/034729.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2010-0288 · Vendor Advisory
• http://debian.org/security/2010/dsa-1976 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-201301-07.xml · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2010-0288 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2010-0288 · Vendor Advisory
• http://osvdb.org/61710 · Note