CVE-2015-2172

MEDIUM 6.5CVE-2015-2172 · Published 30/03/2015 · updated 17/06/2026

In short

CVE-2015-2172 is a MEDIUM (CVSS 6.5) vulnerability affecting dokuwiki (dokuwiki).
Chance of exploitation in the next 30 days (EPSS): 2.9%, higher than 86.8% of all vulnerabilities.
Fix: update to 2014-05-05d, 2014-09-29c or later.

Package	Affected versions	Patched versions
dokuwiki dokuwiki	`≥ 2014-05-05, < 2014-05-05d≥ 2014-09-29, < 2014-09-29c`	`2014-05-05d2014-09-29c`

Description

DokuWiki before 2014-05-05d and before 2014-09-29c does not properly check permissions for the ACL plugins, which allows remote authenticated users to gain privileges and add or delete ACL rules via a request to the XMLRPC API.

References

advisories.mageia.org/MGASA-2015-0093.html · Third Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2015-March/152994.html · Mailing List
lists.fedoraproject.org/pipermail/package-announce/2015-March/153062.html · Mailing List
lists.fedoraproject.org/pipermail/package-announce/2015-March/153266.html · Mailing List
openwall.com/lists/oss-security/2015/03/02/2 · Mailing List
securityfocus.com/bid/72827 · Third Party Advisory
splitbrain/dokuwiki commit 4970ad2 · Third Party Advisory
splitbrain/dokuwiki · Third Party Advisory
dokuwiki.org/changes · Vendor Advisory

More vulnerabilities in dokuwiki

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

dokuwiki

≥ 2014-05-05, < 2014-05-05d≥ 2014-09-29, < 2014-09-29c

2014-05-05d2014-09-29c

More vulnerabilities in dokuwiki

See all →