PT-2020-7137 · Unknown · Tikiwiki Cms/Groupware

Published 2020-01-15 · Updated 2020-01-21 · CVE-2011-4336

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Tiki Wiki CMS Groupware version 7.0

Description The issue concerns a cross-site scripting (XSS) problem. It occurs via the GET "ajax" parameter to the "snarf ajax.php" endpoint. This allows for potential exploitation.

Recommendations For Tiki Wiki CMS Groupware version 7.0, consider restricting access to the "snarf ajax.php" endpoint until a fix is available. As a temporary workaround, avoid using the ajax parameter in the GET request to this endpoint.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2011-4336

Affected Products

Tikiwiki Cms/Groupware

References · 6

• 🔥 https://exploit-db.com/exploits/35974 · Exploit
• 🔥 https://seclists.org/bugtraq/2011/Nov/140 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-4336 · Security Note
• https://securityfocus.com/bid/48806/info · Note
• https://t.me/cibsecurity/9207 · Telegram Post
• https://t.me/cibsecurity/9316 · Telegram Post