PRIOn knowledge basePRION:CVE-2015-2172Cross site request forgery (csrf)
6.9 Medium
AI Score
Confidence
Low
6.5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
0.011 Low
EPSS
Percentile
83.7%
DokuWiki before 2014-05-05d and before 2014-09-29c does not properly check permissions for the ACL plugins, which allows remote authenticated users to gain privileges and add or delete ACL rules via a request to the XMLRPC API.
| CPE | Name | Operator | Version |
|---|---|---|---|
| dokuwiki | eq | >= 2014929 AND < 2014929c | |
| dokuwiki | eq | >= 201455 AND < 201455d |
References
advisories.mageia.org/MGASA-2015-0093.html
www.openwall.com/lists/oss-security/2015/03/02/2
www.securityfocus.com/bid/72827
github.com/splitbrain/dokuwiki/commit/4970ad24ce49ec76a0ee67bca7594f918ced2f5f
github.com/splitbrain/dokuwiki/issues/1056
lists.fedoraproject.org/pipermail/package-announce/2015-March/152994.html
lists.fedoraproject.org/pipermail/package-announce/2015-March/153062.html
lists.fedoraproject.org/pipermail/package-announce/2015-March/153266.html
www.dokuwiki.org/changes
Related
6.9 Medium
AI Score
Confidence
Low
6.5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
0.011 Low
EPSS
Percentile
83.7%