Description
UI/Manage.pm in Foswiki 1.1.0 and 1.1.1 allows remote authenticated users to gain privileges by modifying the GROUP and ALLOWTOPICCHANGE preferences in the topic preferences for Main.AdminGroup.
References
- 44858 vdb-entry
- foswiki-manage-priv-escalation(63253) vdb-entry
- http://foswiki.org/Support/SecurityAlertCVE20104215
- [foswiki-announce] 20101110 [ANNOUNCE] Foswiki Security Alert CVE-2010-4215 - User can alter topic preferences using the "Edit topic preference settings" feature and save them even though he has no privileges to edit the topic. mailing-list
- 42275 third-party-advisory