CVE-2010-0288
A typo in the administrator permission check in the ACL Manager plugin (plugins/acl/ajax.php) in DokuWiki before 2009-12-25b allows remote attackers to gain privileges and access closed wikis by editing current ACL statements, as demonstrated in the…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 10.5%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.
Description
A typo in the administrator permission check in the ACL Manager plugin (plugins/acl/ajax.php) in DokuWiki before 2009-12-25b allows remote attackers to gain privileges and access closed wikis by editing current ACL statements, as demonstrated in the wild in January 2010.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 10.55% probability · 96th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- dokuwiki/dokuwiki
- Source
- secalert@redhat.com
References
- http://bugs.splitbrain.org/index.php?do=details&task_id=1847
- http://lists.fedoraproject.org/pipermail/package-announce/2010-February/034729.html
- http://lists.fedoraproject.org/pipermail/package-announce/2010-February/034831.html
- http://osvdb.org/61710
- http://secunia.com/advisories/38183Vendor Advisory
- http://security.gentoo.org/glsa/glsa-201301-07.xml
- http://www.debian.org/security/2010/dsa-1976
- http://www.exploit-db.com/exploits/11141
- http://www.securityfocus.com/bid/37820
- http://www.splitbrain.org/blog/2010-01/17-dokuwiki-security
- http://www.vupen.com/english/advisories/2010/0150
- https://exchange.xforce.ibmcloud.com/vulnerabilities/55661
- http://bugs.splitbrain.org/index.php?do=details&task_id=1847
- http://lists.fedoraproject.org/pipermail/package-announce/2010-February/034729.html
- http://lists.fedoraproject.org/pipermail/package-announce/2010-February/034831.html
- http://osvdb.org/61710
- http://secunia.com/advisories/38183Vendor Advisory
- http://security.gentoo.org/glsa/glsa-201301-07.xml
- http://www.debian.org/security/2010/dsa-1976
- http://www.exploit-db.com/exploits/11141
- http://www.securityfocus.com/bid/37820
- http://www.splitbrain.org/blog/2010-01/17-dokuwiki-security
- http://www.vupen.com/english/advisories/2010/0150
- https://exchange.xforce.ibmcloud.com/vulnerabilities/55661
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.