Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Advisory: ikiwiki — DSA-3760 Clear all filters
TI-2017-00331 CVE-2017-0356 · GHSA-v4mw-26wf-pfx6

Authentication bypass via repeated parameters

Priority MEDIUM 48

A flaw, similar to to CVE-2016-9646, exists in ikiwiki before 3.20170111, in the passwordauth plugin's use of CGI::FormBuilder, allowing an attacker to bypass authentication via repeated parameters.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.03276 Published 2018-04-13 Fixed in 3.20170111 CWE-287
TI-2016-07850 CVE-2016-9646 · GHSA-fvvm-x83v-fc5r

Commit metadata forgery via CGI::FormBuilder context-dependent APIs

Priority LOW 26

ikiwiki before 3.20161229 incorrectly called the CGI::FormBuilder->field method (similar to the CGI->param API that led to Bugzilla's CVE-2014-1572), which can be abused to lead to commit metadata forgery.

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.01138 Published 2018-04-13 Fixed in 3.20161229 CWE-287