The versions listed below are known to be affected by this issue. If you are using one of those versions, you should update to a newer release that has no known vulnerabilities.
Common Name None VWE-ID VWE-2010-0136 Related Report #2157 Severity MEDIUM Exploit Difficulty NORMAL Platform Affects all platforms supported by the vulnerable versions. Description Permissions escalation. A user can remove attachments from wiki content they do not have permission to edit, as long as the attachment was originally uploaded by them, and as long as they have permission to edit and change attachments for other wiki content.
Discovered December 13, 2010 Resolved December 17, 2010 Patches Available 3.0.8 Notes
After some brief deliberation, this permissions escalation was incorrectly handled as a standard bug at the time it was patched. As a result, patches of other issues for earlier versions in the 3.x series continued to have this issue, even though they were released after this issue was patched.
This page has been seen 5,022 times.
-
-
Created by on
-