CVE-2008-0169: Medium severity ikiwiki hosting project vulnerability

Published Jun 3, 2008

Updated

Plugin/passwordauth.pm (aka the passwordauth plugin) in ikiwiki 1.34 through 2.47 allows remote attackers to bypass authentication, and login to any account for which an OpenID identity is configured and a password is not configured, by specifying an empty password during the login sequence.

Affected Software

52 affected components

Ikiwiki ikiwiki=1.5

Ikiwiki ikiwiki=1.34

Ikiwiki ikiwiki=1.34.1

Ikiwiki ikiwiki=1.34.2

Ikiwiki ikiwiki=1.35

Ikiwiki ikiwiki=1.36

Ikiwiki ikiwiki=1.37

Ikiwiki ikiwiki=1.38

Ikiwiki ikiwiki=1.39

Ikiwiki ikiwiki=1.40

Ikiwiki ikiwiki=1.41

Ikiwiki ikiwiki=1.42

Ikiwiki ikiwiki=1.43

Ikiwiki ikiwiki=1.44

Ikiwiki ikiwiki=1.45

Ikiwiki ikiwiki=1.46

Ikiwiki ikiwiki=1.47

Ikiwiki ikiwiki=1.48

Ikiwiki ikiwiki=1.49

Ikiwiki ikiwiki=1.51

Ikiwiki ikiwiki=2.0

Ikiwiki ikiwiki=2.1

Ikiwiki ikiwiki=2.2

Ikiwiki ikiwiki=2.3

Ikiwiki ikiwiki=2.4

Ikiwiki ikiwiki=2.5

Ikiwiki ikiwiki=2.6

Ikiwiki ikiwiki=2.7

Ikiwiki ikiwiki=2.8

Ikiwiki ikiwiki=2.9

Ikiwiki ikiwiki=2.10

Ikiwiki ikiwiki=2.11

Ikiwiki ikiwiki=2.12

Ikiwiki ikiwiki=2.13

Ikiwiki ikiwiki=2.14

Ikiwiki ikiwiki=2.15

Ikiwiki ikiwiki=2.16

Ikiwiki ikiwiki=2.17

Ikiwiki ikiwiki=2.18

Ikiwiki ikiwiki=2.19

Ikiwiki ikiwiki=2.20

Ikiwiki ikiwiki=2.30

Ikiwiki ikiwiki=2.31

Ikiwiki ikiwiki=2.31.1

Ikiwiki ikiwiki=2.31.2

Ikiwiki ikiwiki=2.31.3

Ikiwiki ikiwiki=2.40

Ikiwiki ikiwiki=2.41

Ikiwiki ikiwiki=2.42

Ikiwiki ikiwiki=2.43

Ikiwiki ikiwiki=2.44

Ikiwiki ikiwiki=2.47

Event History

Jun 3, 2008

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2008-0169?

CVE-2008-0169 has a medium severity level as it allows remote attackers to bypass authentication.

How do I fix CVE-2008-0169?

To fix CVE-2008-0169, update ikiwiki to version 2.48 or later where this vulnerability is patched.

What versions of ikiwiki are affected by CVE-2008-0169?

CVE-2008-0169 affects versions of ikiwiki from 1.34 to 2.47.

What does CVE-2008-0169 exploit?

CVE-2008-0169 exploits a flaw in the passwordauth plugin that allows login without a password for certain OpenID accounts.

Who can be targeted by CVE-2008-0169?

CVE-2008-0169 can target any user account configured with an OpenID identity without a password.