|
|
| |
|
| |
dokuwiki: multiple vulnerabilities
| Package(s): | dokuwiki |
CVE #(s): | CVE-2010-0287
CVE-2010-0288
CVE-2010-0289
|
| Created: | January 22, 2010 |
Updated: | January 27, 2010 |
| Description: |
From the Debian advisory:
It was discovered that an internal variable is not properly sanitized before
being used to list directories. This can be exploited to list contents of
arbitrary directories. CVE-2010-0287
It was discovered that the ACL Manager plugin doesn't properly check the
administrator permissions. This allow an attacker to introduce arbitrary ACL rules and thus gaining access to a closed Wiki. CVE-2010-0288
It was discovered that the ACL Manager plugin doesn't have protections against cross-site request forgeries (CSRF). This can be exploited to change the access control rules by tricking a logged in administrator into visiting a malicious web site. CVE-2010-0289
|
| Alerts: |
|
( Log in to post comments)
|
|
|