The versions listed below are known to be affected by this issue. If you are using one of those versions, you should update to a newer release that has no known vulnerabilities.
Common Name None VWE-ID VWE-2017-3978 Related Report None Severity Extreme Exploit Difficulty Difficult Platform Affects all platforms supported by the vulnerable versions. Description Remote Code Execution. When importing from VaultWiki 3 or 4 and using the undocumented $api_path capability: if the DNS is compromised, or if the remote server is compromised, the compromised server may be able to execute commands against the server running VaultWiki. Does not affect Lite versions.
Discovered August 9, 2017 Resolved September 13, 2017 Patches Available 4.0.19 Patch Level 1
4.0.18 Patch Level 2
4.0.17 Patch Level 4
4.0.16 Patch Level 5
4.0.15 Patch Level 9
4.0.14 Patch Level 12
Workaround Patches are not ready yet. Do not use $api_path for imports.
Categories: XSS:4.0.0 Beta 6, XSS:4.0.0 Beta 7, XSS:4.0.0 Gamma 1, XSS:4.0.0 Gamma 2, XSS:4.0.0 Gamma 3, XSS:4.0.0 Gamma 4, XSS:4.0.0 Gamma 5, XSS:4.0.0 Gamma 6, XSS:4.0.0 Gamma 7, XSS:4.0.0 Patch Level 1, XSS:4.0.0 Patch Level 2, XSS:4.0.0 Patch Level 3, XSS:4.0.0 Patch Level 4, XSS:4.0.0 Patch Level 5, XSS:4.0.0 Patch Level 6, XSS:4.0.0 Patch Level 7, XSS:4.0.0 Patch Level 8, XSS:4.0.0 Patch Level 9, XSS:4.0.0 RC 1 Patch Level 1, XSS:4.0.0 RC 1 Patch Level 2, XSS:4.0.0 RC 1 Patch Level 3, XSS:4.0.0 RC 1 Patch Level 4, XSS:4.0.0 RC 1 Patch Level 5, XSS:4.0.0 RC 1 Patch Level 6, XSS:4.0.0 RC 1 Patch Level 7, More…