QwikSec

Security Database

CVE

CWE

Training

CVE-2017-14925

Published: Sep 29, 2017

Modified: Aug 5, 2024

PUBLISHED

Description

Cross-Site Request Forgery (CSRF) vulnerability via IMG element in Tiki before 16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, and 15 LTS before 15.5 LTS allows an authenticated user to edit global permissions if an administrator opens a wiki page with an IMG element, related to tiki-objectpermissions.php. For example, an attacker could assign administrator privileges to every unauthenticated user of the site.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

http://openwall.com/lists/oss-security/2017/09/28/13

x_refsource_MISC

https://tiki.org/article449-Security-and-bug-fix-updates-Tiki-17-1-Tiki-16-3-15-5-and-Tiki-12-12-released

x_refsource_MISC

https://sourceforge.net/p/tikiwiki/code/63872

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.