Skip to content
OpenAdvisories
Unscored DSA-3760-1 3 CVEs

ikiwiki - security update

Published Jan 12, 2017 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 8 ikiwiki 3.20141016.4

Vulnerabilities 3

  • Unscored —
    CVE-2016-10026

    ikiwiki 3.20161219 does not properly check if a revision changes the access permissions for a page on sites with the gi…

    ikiwiki ikiwiki Debian Ubuntu
  • Unscored —
    CVE-2016-9646

    Commit metadata forgery via CGI::FormBuilder context-dependent APIs

    ikiwiki before 3.20161229 incorrectly called the CGI::FormBuilder->field method (similar to the CGI->param API that led to Bugzilla's CVE-2014-1572), which can be abused to lead to commit metadata forgery.

    ikiwiki ikiwiki ikiwiki ikiwiki Debian Ubuntu
  • Unscored —
    CVE-2017-0356

    Authentication bypass via repeated parameters

    A flaw, similar to to CVE-2016-9646, exists in ikiwiki before 3.20170111, in the passwordauth plugin's use of CGI::FormBuilder, allowing an attacker to bypass authentication via repeated parameters.

    ikiwiki ikiwiki ikiwiki ikiwiki Debian Ubuntu