oss-sec mailing list archives
XSS vulnerability in Tiki < 18
From: chbi () chbi eu
Date: Fri, 16 Feb 2018 17:40:17 +0100
Hi, I've discovered a security issue in Tiki < 18 (https://tiki.org) A XSS vulnerability via SVG image allows an authenticated user to gain administrator privileges if an administrator opens a wiki page with a malicious SVG image, related to filegallib.php. Fix: https://sourceforge.net/p/tikiwiki/code/65327 The issue is fixed in Tiki 18. I've requested a CVE ID (MITRE). -- chbi https://chbi.eu GPG: 3DE9 9187 4BE9 EAE6 3CA8 DC20 BA7B 93F9 9037 AE7E https://chbi.eu/chbi.asc
Attachment:
signature.asc
Description: OpenPGP digital signature
Current thread:
- XSS vulnerability in Tiki < 18 chbi (Feb 16)
- Re: XSS vulnerability in Tiki < 18 chbi (Feb 16)