PT-2018-5114 · Joey Hess · Ikiwiki
CVE-2016-9646
·
Published
2017-01-12
·
Updated
2024-06-15
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
ikiwiki versions prior to 3.20161229
Description
The issue arises from an incorrect call to the
CGI::FormBuilder->field method, similar to the CGI->param API issue that led to Bugzilla's vulnerability. This can be exploited to forge commit metadata.Recommendations
For versions prior to 3.20161229, update to version 3.20161229 or later to resolve the issue. As a temporary workaround, consider restricting access to the
CGI::FormBuilder->field method until a patch is applied.Fix
Improper Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Ikiwiki