- Home
- CVEs with nessus.description==The remote host is affected by the vulnerability described in GLSA-200611-11 (TikiWiki: Multiple vulnerabilities)
In numerous files TikiWiki provides an empty sort_mode parameter, causing TikiWiki to display additional information, including database authentication credentials, in certain error messages. TikiWiki also improperly sanitizes the 'url' request variable sent to tiki-featured_link.php.
Impact :
An attacker could cause a database error in various pages of a TikiWiki instance by providing an empty sort_mode request variable, and gain unauthorized access to credentials of the MySQL databases used by TikiWiki. An attacker could also entice a user to browse to a specially crafted URL that could run scripts in the scope of the user's browser.
Workaround :
There is no known workaround at this time.
Max CVSS | 0 |
Min CVSS | 0 |
Total Count | 2 |
| ID | CVSS | Summary | Last (major) update | Published |
Back to Top
Mark selected
Back to Top