VaultWiki Security Update: 4 DoS Vulnerabilities

Over the past week, our users and developers have uncovered a combined total of four (4) issues in VaultWiki, that can either be exploited to create a denial of service condition or will create a denial of service condition automatically.

The "Tag Duplication Vulnerability" creates the condition automatically, and it affects VaultWiki 4.0.7 on XenForo only.

The "Node Overload Vulnerability" and "Template Expansion Vulnerability" exist in all versions of VaultWiki 2.x, 3.x, and 4.x series.

The "Template Usage Vulnerability" exists in all versions of VaultWiki 2.3.x, 2.5.x, 3.x, and 4.x series.

These vulnerabilities do not require any technical expertise to exploit. Most of them simply require tedious work and abuse of existing features for an attacker (or group of attackers) to create the condition.

"Node Overload" affects VaultWiki Lite 4.0.0 - 4.0.7.

We have published the following Patch Level releases to resolve these issues:

• 4.0.7 Patch Level 1
• 4.0.6 Patch Level 4
• 4.0.5 Patch Level 4
• 4.0.4 Patch Level 4
• 4.0.3 Patch Level 4
• 4.0.2 Patch Level 7
• 4.0.1 Patch Level 10
• 4.0.0 Patch Level 9
• 4.0.0 RC 5 Patch Level 8

We highly recommend that all users running any version of VaultWiki in a production environment update to a patched release as soon as possible.