VaultWiki Security Update: February 2021

As of February 5, security patches for February 2021 are now available.

Issue List

VWE-2021-6029 is a Permissions Escalation issue, by which users can bypass a required custom field by saving a meaningless value, then subsequently editing it to be blank; the subsequent edit does not complain that the required field was left blank. The issue affects VaultWiki 4.1.0 RC 2 and higher.

VWE-2021-6038 is a Permissions Escalation issue, where an improperly incrementing database key can cause some users to see wiki navigation links based on the permissions of another user. The issue affects VaultWiki 4.0.24 and higher.

Patches

The following patches address the aforementioned issues:

• 4.1.1 Patch Level 2
• 4.1.0 Patch Level 4
• 4.1.0 RC 3 Patch Level 6
• 4.1.0 RC 2 Patch Level 7

4.0.x Retires

This week marked the 1-year anniversary of VaultWiki 4.0.28, which was the last release in the 4.0.x series. Being more than 1 year old, it is no longer eligible for security updates. Because today's security update includes issues affecting 4.0.28, it is no longer considered safe to use and has been removed from the download menu. Consequently, there is now no public access to any 4.0.x version. If you were still waiting to upgrade to 4.1.x, that time is now.

Notes

We recommend that all users running VaultWiki in a production environment update to a patched release.