CVE-2016-10026

Published: Feb 13, 2017Modified: May 13, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

ikiwiki 3.20161219 does not properly check if a revision changes the access permissions for a page on sites with the git and recentchanges plugins and the CGI interface enabled, which allows remote attackers to revert certain changes by leveraging permissions to change the page before the revision was made.

Affected (1)

Products: Ikiwiki: Ikiwiki

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Ikiwiki Ikiwiki	Version 3.20161219

Related CWEs

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (10)

http://ikiwiki.info/bugs/rcs_revert_can_bypass_authorization_if_affected_files_were_renamed/

Source: cve@mitre.org

Issue TrackingVendor Advisory

http://www.debian.org/security/2017/dsa-3760

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2016/12/21/3

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2016/12/29/3

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://ikiwiki.info/security/#index46h2

Source: cve@mitre.org

Vendor Advisory

http://ikiwiki.info/bugs/rcs_revert_can_bypass_authorization_if_affected_files_were_renamed/

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingVendor Advisory

http://www.debian.org/security/2017/dsa-3760

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2016/12/21/3

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2016/12/29/3

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://ikiwiki.info/security/#index46h2

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.