dokuwiki: access control circumvention
| Package(s): | dokuwiki | CVE #(s): | CVE-2015-2172 | ||||||||||||||||||||
| Created: | March 6, 2015 | Updated: | March 27, 2015 | ||||||||||||||||||||
| Description: | From the Mageia advisory: DokuWiki before 20140929c has a security issue in the ACL plugins remote API component. The plugin failed to check for superuser permissions before executing ACL addition or deletion. This means everybody with permissions to call the XMLRPC API also had permissions to set up their own ACL rules and thus circumventing any existing rules. | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||