| Package | Affected versions | Patched versions |
|---|---|---|
| ikiwiki | = 1.34= 1.34.1= 1.34.2= 1.35= 1.36= 1.37= 1.38= 1.39= 1.40= 1.41= 1.42= 1.43= 1.44= 1.45= 1.46= 1.47= 1.48= 1.49= 1.5= 1.51= 2.0= 2.1= 2.10= 2.11= 2.12= 2.13= 2.14= 2.15= 2.16= 2.17= 2.18= 2.19= 2.2= 2.20= 2.3= 2.30= 2.31= 2.31.1= 2.31.2= 2.31.3= 2.4= 2.40= 2.41= 2.42= 2.43= 2.44= 2.47= 2.5= 2.6= 2.7= 2.8= 2.9 |
Plugin/passwordauth.pm (aka the passwordauth plugin) in ikiwiki 1.34 through 2.47 allows remote attackers to bypass authentication, and login to any account for which an OpenID identity is configured and a password is not configured, by specifying an empty password during the login sequence.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free