7.5

CVE-2016-10026

EPSS 0.38%
Published 13.02.2017 18:59:00
Last modified 20.04.2025 01:37:25
Source cve@mitre.org
Teams watchlist Login
Open Login

ikiwiki 3.20161219 does not properly check if a revision changes the access permissions for a page on sites with the git and recentchanges plugins and the CGI interface enabled, which allows remote attackers to revert certain changes by leveraging permissions to change the page before the revision was made.

Affected products Warnungen 0 Metrics 3 CWE 1 References 8

Data is provided by the National Vulnerability Database (NVD)

Ikiwiki ≫ Ikiwiki Version3.20161219

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.38%	0.562

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	7.5	3.9	3.6	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvd@nist.gov	5	10	2.9	AV:N/AC:L/Au:N/C:N/I:P/A:N

CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

http://ikiwiki.info/bugs/rcs_revert_can_bypass_authorization_if_affected_files_were_renamed/

Vendor Advisory

Issue Tracking

http://www.debian.org/security/2017/dsa-3760

http://www.openwall.com/lists/oss-security/2016/12/21/3

Third Party Advisory

Mailing List

http://www.openwall.com/lists/oss-security/2016/12/29/3

Third Party Advisory

Mailing List

https://ikiwiki.info/security/#index46h2

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2016-10026

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2016-10026

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2016-10026

EUVD