PT-2017-18727 · Tiki · Tikiwiki Cms/Groupware

Lindonb · Published 2017-06-26 · Updated 2017-07-05 · CVE-2017-9145

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Tiki Wiki CMS Groupware versions 12.x through 16.x

Description The issue is related to improper validation of the imgsize or lang parameter in TikiFilter.php, which can lead to XSS.

Recommendations For versions 12.x through 16.x, update the TikiFilter.php to properly validate the imgsize and lang parameters to prevent XSS.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-9145

Affected Products

Tikiwiki Cms/Groupware

References · 3

• https://osv.dev/vulnerability/CVE-2017-9145 · Vendor Advisory
• https://sourceforge.net/p/tikiwiki/code/62386 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2017-9145 · Security Note