PT-2020-14703 · Tiki · Tiki

Published 2020-10-22 · Updated 2024-01-01 · CVE-2020-15906

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tiki versions prior to 21.2

Description The issue allows an attacker to set the admin password to a blank value after a certain number of invalid login attempts. There have been reports of activities targeting this issue.

Recommendations For versions prior to 21.2, update to version 21.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the tiki-login.php file to minimize the risk of exploitation.

Exploit

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2020-15906

Affected Products

Tiki

References · 7

• 🔥 https://github.com/S1lkys/CVE-2020-15906 · Exploit
• 🔥 http://packetstormsecurity.com/files/159663/Tiki-Wiki-CMS-Groupware-21.1-Authentication-Bypass.html · Exploit
• https://info.tiki.org/article473-Security-Releases-of-all-Tiki-versions-since-16-3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-15906 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15906 · Security Note
• https://twitter.com/vuldb/status/1739639467026305031 · Twitter Post
• https://twitter.com/vuldb/status/1741735520747823544 · Twitter Post