CVEvulnerability

CVE-2017-14924

8.0 HIGH Published 2017-09-30 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2017-09-30
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
8.0 HIGH — CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.0 MEDIUM — AV:N/AC:M/Au:S/C:P/I:P/A:P
Weaknesses
CWE-352

Description

Cross-Site Request Forgery (CSRF) vulnerability via IMG element in Tiki before 16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, and 15 LTS before 15.5 LTS allows an authenticated user to gain administrator privileges if an administrator opens a wiki page with an IMG element, related to tiki-assignuser.php.

Affected configurations

• tiki tikiwiki cms\/groupware 12.0 • tiki tikiwiki cms\/groupware 12.1 • tiki tikiwiki cms\/groupware 12.2 • tiki tikiwiki cms\/groupware 12.3 • tiki tikiwiki cms\/groupware 12.4 • tiki tikiwiki cms\/groupware 12.5 • tiki tikiwiki cms\/groupware 12.6 • tiki tikiwiki cms\/groupware 12.7 • tiki tikiwiki cms\/groupware 12.8 • tiki tikiwiki cms\/groupware 12.9 • tiki tikiwiki cms\/groupware 12.10 • tiki tikiwiki cms\/groupware 12.11 • tiki tikiwiki cms\/groupware 15.0 • tiki tikiwiki cms\/groupware 15.1 • tiki tikiwiki cms\/groupware 15.2 • tiki tikiwiki cms\/groupware 15.3 • tiki tikiwiki cms\/groupware 15.4 • tiki tikiwiki cms\/groupware 16.0 • tiki tikiwiki cms\/groupware 16.1 • tiki tikiwiki cms\/groupware 16.2 • tiki tikiwiki cms\/groupware 17.0

Related

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References