Privilege Escalation in DokuWiki by Unauthenticated Remote Users
CVE-2015-2172

Currently unrated

Key Information:

Vendor

Dokuwiki

Status
Dokuwiki
Vendor
CVE Published:
30 March 2015

What is CVE-2015-2172?

DokuWiki versions prior to 2014-05-05d and 2014-09-29c are affected by a flaw in the handling of permissions for its ACL plugins. This vulnerability enables remote authenticated users to manipulate access control lists (ACL) through the XMLRPC API, allowing them to add or delete ACL rules without proper authorization, potentially compromising the integrity of the system's access controls.

References

https://github.com/splitbrain/dokuwiki/issues/1056
x_refsource_CONFIRM
http://lists.fedoraproject.org/pipermail/package-announce...
vendor-advisoryx_refsource_FEDORA
https://github.com/splitbrain/dokuwiki/commit/4970ad24ce4...
x_refsource_CONFIRM

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.