Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2017-14924

Cross-Site Request Forgery (CSRF) vulnerability via IMG element in Tiki before 16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, and 15 LTS before 15.5 LTS allows an authenticated user to gain administrator privileges if an administrator opens a wiki page with an IMG element, related to tiki-assignuser.php.

Published

2017-09-30T01:29:02.037

Last Modified

2025-04-20T01:37:25.860

Status

Deferred

Source

[email protected]

Severity

CVSSv3.0: 8.0 (HIGH)

CVSSv2 Vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: SINGLE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Exploitability Score

6.8

Impact Score

6.4

Weaknesses

Type: Primary
CWE-352

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	tiki	tikiwiki_cms\/groupware	12.0	Yes
Application	tiki	tikiwiki_cms\/groupware	12.1	Yes
Application	tiki	tikiwiki_cms\/groupware	12.2	Yes
Application	tiki	tikiwiki_cms\/groupware	12.3	Yes
Application	tiki	tikiwiki_cms\/groupware	12.4	Yes
Application	tiki	tikiwiki_cms\/groupware	12.5	Yes
Application	tiki	tikiwiki_cms\/groupware	12.6	Yes
Application	tiki	tikiwiki_cms\/groupware	12.7	Yes
Application	tiki	tikiwiki_cms\/groupware	12.8	Yes
Application	tiki	tikiwiki_cms\/groupware	12.9	Yes
Application	tiki	tikiwiki_cms\/groupware	12.10	Yes
Application	tiki	tikiwiki_cms\/groupware	12.11	Yes
Application	tiki	tikiwiki_cms\/groupware	15.0	Yes
Application	tiki	tikiwiki_cms\/groupware	15.1	Yes
Application	tiki	tikiwiki_cms\/groupware	15.2	Yes
Application	tiki	tikiwiki_cms\/groupware	15.3	Yes
Application	tiki	tikiwiki_cms\/groupware	15.4	Yes
Application	tiki	tikiwiki_cms\/groupware	16.0	Yes
Application	tiki	tikiwiki_cms\/groupware	16.1	Yes
Application	tiki	tikiwiki_cms\/groupware	16.2	Yes
Application	tiki	tikiwiki_cms\/groupware	17.0	Yes

References

http://openwall.com/lists/oss-security/2017/09/28/13 Mailing List, Third Party Advisory ([email protected])
https://sourceforge.net/p/tikiwiki/code/63829 Patch, Third Party Advisory ([email protected])
https://tiki.org/article449-Security-and-bug-fix-updates-Tiki-17-1-Tiki-16-3-15-5-and-Tiki-12-12-released Patch, Release Notes, Vendor Advisory ([email protected])
http://openwall.com/lists/oss-security/2017/09/28/13 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://sourceforge.net/p/tikiwiki/code/63829 Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://tiki.org/article449-Security-and-bug-fix-updates-Tiki-17-1-Tiki-16-3-15-5-and-Tiki-12-12-released Patch, Release Notes, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)