CVE-2017-14925: CSRF
First published: Sat Sep 30 2017(Updated: )
Cross-Site Request Forgery (CSRF) vulnerability via IMG element in Tiki before 16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, and 15 LTS before 15.5 LTS allows an authenticated user to edit global permissions if an administrator opens a wiki page with an IMG element, related to tiki-objectpermissions.php. For example, an attacker could assign administrator privileges to every unauthenticated user of the site.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Tiki Wiki CMS Groupware | =12.0 | |
| Tiki Wiki CMS Groupware | =12.1 | |
| Tiki Wiki CMS Groupware | =12.2 | |
| Tiki Wiki CMS Groupware | =12.3 | |
| Tiki Wiki CMS Groupware | =12.4 | |
| Tiki Wiki CMS Groupware | =12.5 | |
| Tiki Wiki CMS Groupware | =12.6 | |
| Tiki Wiki CMS Groupware | =12.7 | |
| Tiki Wiki CMS Groupware | =12.8 | |
| Tiki Wiki CMS Groupware | =12.9 | |
| Tiki Wiki CMS Groupware | =12.10 | |
| Tiki Wiki CMS Groupware | =12.11 | |
| Tiki Wiki CMS Groupware | =15.0 | |
| Tiki Wiki CMS Groupware | =15.1 | |
| Tiki Wiki CMS Groupware | =15.2 | |
| Tiki Wiki CMS Groupware | =15.3 | |
| Tiki Wiki CMS Groupware | =15.4 | |
| Tiki Wiki CMS Groupware | =16.0 | |
| Tiki Wiki CMS Groupware | =16.1 | |
| Tiki Wiki CMS Groupware | =16.2 | |
| Tiki Wiki CMS Groupware | =17.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2017-14925?
CVE-2017-14925 has a moderate severity rating due to its potential impact on global permissions in Tiki applications.
How do I fix CVE-2017-14925?
To fix CVE-2017-14925, upgrade your Tiki installation to versions 12.12 LTS, 15.5 LTS, 16.3, or 17.1 or later.
What versions of Tiki are affected by CVE-2017-14925?
CVE-2017-14925 affects Tiki versions 12.0 to 12.11, 15.0 to 15.4, and 16.0 to 16.2.
Can CVE-2017-14925 be exploited without user interaction?
CVE-2017-14925 requires user interaction, as it exploits authenticated users opening a specially crafted wiki page.
What type of vulnerability is CVE-2017-14925?
CVE-2017-14925 is classified as a Cross-Site Request Forgery (CSRF) vulnerability.
- agent/references
- agent/severity
- agent/author
- agent/type
- agent/weakness
- agent/tags
- agent/event
- agent/description
- agent/remedy
- agent/first-publish-date
- agent/last-modified-date
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/tiki
- canonical/tiki wiki cms groupware
- version/tiki wiki cms groupware/12.0
- version/tiki wiki cms groupware/12.1
- version/tiki wiki cms groupware/12.2
- version/tiki wiki cms groupware/12.3
- version/tiki wiki cms groupware/12.4
- version/tiki wiki cms groupware/12.5
- version/tiki wiki cms groupware/12.6
- version/tiki wiki cms groupware/12.7
- version/tiki wiki cms groupware/12.8
- version/tiki wiki cms groupware/12.9
- version/tiki wiki cms groupware/12.10
- version/tiki wiki cms groupware/12.11
- version/tiki wiki cms groupware/15.0
- version/tiki wiki cms groupware/15.1
- version/tiki wiki cms groupware/15.2
- version/tiki wiki cms groupware/15.3
- version/tiki wiki cms groupware/15.4
- version/tiki wiki cms groupware/16.0
- version/tiki wiki cms groupware/16.1
- version/tiki wiki cms groupware/16.2
- version/tiki wiki cms groupware/17.0