CVEvulnerability
CVE-2010-1136
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2010-03-27
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-264
Description
The Standard Remember method in TikiWiki CMS/Groupware 3.x before 3.5 allows remote attackers to bypass access restrictions related to "persistent login," probably due to the generation of predictable cookies based on the IP address and User agent in userslib.php.
Affected configurations
• tiki tikiwiki cms\/groupware 3.0
• tiki tikiwiki cms\/groupware 3.1
• tiki tikiwiki cms\/groupware 3.2
• tiki tikiwiki cms\/groupware 3.3
• tiki tikiwiki cms\/groupware 3.4
Related
Weakness · not in database (1)
References
- http://info.tikiwiki.org/article86-Tiki-Announces-3-5-and-4-2-Releases info.tikiwiki.org
- http://osvdb.org/62801 osvdb.org
- http://secunia.com/advisories/38882 Vendor Advisory
- http://tikiwiki.svn.sourceforge.net/viewvc/tikiwiki/branches/proposals/3.x/lib/userslib.php?r1=25196&r2=25195&pathrev=25196 tikiwiki.svn.sourceforge.net
- http://tikiwiki.svn.sourceforge.net/viewvc/tikiwiki?view=rev&revision=25196 tikiwiki.svn.sourceforge.net
- http://www.securityfocus.com/bid/38608 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/56771 exchange.xforce.ibmcloud.com
- http://info.tikiwiki.org/article86-Tiki-Announces-3-5-and-4-2-Releases info.tikiwiki.org
- http://osvdb.org/62801 osvdb.org
- http://secunia.com/advisories/38882 Vendor Advisory
- http://tikiwiki.svn.sourceforge.net/viewvc/tikiwiki/branches/proposals/3.x/lib/userslib.php?r1=25196&r2=25195&pathrev=25196 tikiwiki.svn.sourceforge.net
- http://tikiwiki.svn.sourceforge.net/viewvc/tikiwiki?view=rev&revision=25196 tikiwiki.svn.sourceforge.net
- http://www.securityfocus.com/bid/38608 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/56771 exchange.xforce.ibmcloud.com