PT-2017-7712 · Joey Hess · Ikiwiki

Intrigeri · Published 2017-01-12 · Updated 2024-06-15 · CVE-2016-10026

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions ikiwiki version 3.20161219

Description The issue arises from inadequate checking of revision changes to access permissions for a page on sites utilizing the git and recentchanges plugins with the CGI interface enabled. This allows remote attackers to revert specific changes by exploiting permissions to modify the page before the revision was made.

Recommendations For ikiwiki version 3.20161219, consider disabling the CGI interface or restricting access to the git and recentchanges plugins as a temporary workaround until a patch is available.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2016-10026

DLA-812-1

DSA-3760-1

MGASA-2019-0113

OPENSUSE-SU-2024:10860-1

Affected Products

Ikiwiki

References · 37

• https://security-tracker.debian.org/tracker/CVE-2016-10026 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3760-1 · Vendor Advisory
• https://ikiwiki.info/security/#index46h2 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-10026 · Vendor Advisory
• http://ikiwiki.info/bugs/rcs_revert_can_bypass_authorization_if_affected_files_were_renamed · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-10026 · Vendor Advisory
• https://debian.org/security/2019/dsa-4399 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-10026 · Vendor Advisory
• http://debian.org/security/2017/dsa-3760 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-10026 · Security Note
• https://advisories.mageia.org/MGASA-2019-0113.html · Security Note
• https://cve.org/CVERecord?id=CVE-2016-10026 · Security Note
• https://osv.dev/vulnerability/CVE-2016-10026 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10860-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2019-0113 · Vendor Advisory