FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

ikiwiki -- authentication bypass vulnerability

Affected packages
ikiwiki < 3.20170111

Details

VuXML ID 7b35a77a-0151-11e7-ae1b-002590263bf5
Discovery 2017-01-11
Entry 2017-03-05

ikiwiki reports:

The ikiwiki maintainers discovered further flaws similar to CVE-2016-9646 in the passwordauth plugin's use of CGI::FormBuilder, with a more serious impact:

An attacker who can log in to a site with a password can log in as a different and potentially more privileged user.

An attacker who can create a new account can set arbitrary fields in the user database for that account

[source]

References

CVE Name CVE-2017-0356
URL https://ikiwiki.info/security/#index48h2

Copyright © 2003-2005 Jacques Vidrine and contributors.
Please see the source of this document for full copyright information.