CVE-2017-14924: CSRF
Cross-Site Request Forgery (CSRF) vulnerability via IMG element in Tiki before 16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, and 15 LTS before 15.5 LTS allows an authenticated user to gain administrator privileges if an administrator opens a wiki page with an IMG element, related to tiki-assignuser.php.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-14924?
CVE-2017-14924 is classified as a critical Cross-Site Request Forgery (CSRF) vulnerability.
How do I fix CVE-2017-14924?
To fix CVE-2017-14924, upgrade Tiki to version 16.3, 17.1, 15.5 LTS, or 12.12 LTS or later.
Which versions of Tiki are affected by CVE-2017-14924?
CVE-2017-14924 affects Tiki versions prior to 16.3, 17.1, 15.5 LTS, and 12.12 LTS.
What can an attacker achieve using CVE-2017-14924?
An attacker can gain administrator privileges if an administrator opens a malicious wiki page containing an IMG element.
Who is vulnerable to CVE-2017-14924?
Authenticated users of Tiki platforms running the specified vulnerable versions are at risk of CVE-2017-14924.