National Cyber Awareness System

Vulnerability Summary for CVE-2010-0288

Overview

A typo in the administrator permission check in the ACL Manager plugin (plugins/acl/ajax.php) in DokuWiki before 2009-12-25b allows remote attackers to gain privileges and access closed wikis by editing current ACL statements, as demonstrated in the wild in January 2010.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: XF

Name: dokuwiki-ajax-security-bypass(55661)

Hyperlink:http://xforce.iss.net/xforce/xfdb/55661

External Source: VUPEN

Name: ADV-2010-0150

Hyperlink:http://www.vupen.com/english/advisories/2010/0150

External Source: CONFIRM

Name: http://www.splitbrain.org/blog/2010-01/17-dokuwiki-security

Hyperlink:http://www.splitbrain.org/blog/2010-01/17-dokuwiki-security

External Source: BID

Name: 37820

Hyperlink:http://www.securityfocus.com/bid/37820

External Source: EXPLOIT-DB

Name: 11141

Hyperlink:http://www.exploit-db.com/exploits/11141

External Source: DEBIAN

Name: DSA-1976

Hyperlink:http://www.debian.org/security/2010/dsa-1976

External Source: SECUNIA

Name: 38183

Type: Advisory

Hyperlink:http://secunia.com/advisories/38183

External Source: OSVDB

Name: 61710

Hyperlink:http://osvdb.org/61710

External Source: FEDORA

Name: FEDORA-2010-0800

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2010-February/034831.html

External Source: FEDORA

Name: FEDORA-2010-0770

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2010-February/034729.html

External Source: CONFIRM

Name: http://bugs.splitbrain.org/index.php?do=details&task_id=1847

Hyperlink:http://bugs.splitbrain.org/index.php?do=details&task_id=1847