PT-2017-13759 · Tiki · Tiki

Chbi · Published 2017-09-29 · Updated 2017-10-06 · CVE-2017-14925

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tiki versions prior to 16.3 Tiki versions 17.x prior to 17.1 Tiki versions 12.x prior to 12.12 LTS Tiki versions 15.x prior to 15.5 LTS

Description A Cross-Site Request Forgery (CSRF) issue exists via the IMG element, allowing an authenticated user to modify global permissions if an administrator opens a malicious wiki page. This could lead to assigning administrator privileges to unauthenticated users, related to the tiki-objectpermissions.php file.

Recommendations For Tiki versions prior to 16.3, update to version 16.3 or later. For Tiki versions 17.x prior to 17.1, update to version 17.1 or later. For Tiki versions 12.x prior to 12.12 LTS, update to version 12.12 LTS or later. For Tiki versions 15.x prior to 15.5 LTS, update to version 15.5 LTS or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2017-14925

Affected Products

Tiki

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-14925 · Security Note
• https://osv.dev/vulnerability/CVE-2017-14925 · Vendor Advisory
• https://tiki.org/article449-Security-and-bug-fix-updates-Tiki-17-1-Tiki-16-3-15-5-and-Tiki-12-12-released · Vendor Advisory
• https://sourceforge.net/p/tikiwiki/code/63872 · Patch
• http://openwall.com/lists/oss-security/2017/09/28/13 · Note