CVE-2016-9646 - Vulnerability Details - OpenCVE

ikiwiki before 3.20161229 incorrectly called the CGI::FormBuilder->field method (similar to the CGI->param API that led to Bugzilla's CVE-2014-1572), which can be abused to lead to commit metadata forgery.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00262.

Key SSVC decision points have not yet been added.

Vendors	Products
Debian	Debian Linux
Ikiwiki	Ikiwiki

Configuration 1 [-]

cpe:2.3:a:ikiwiki:ikiwiki:*:*:*:*:*:*:*:*

Configuration 2 [-]

OR	cpe:2.3:o:debian:debian_linux:7.0:::::::*
	cpe:2.3:o:debian:debian_linux:8.0:::::::*
	cpe:2.3:o:debian:debian_linux:9.0:::::::*

No data.

No data.

Advisories

Source	ID	Title
Debian DLA	DLA-812-1	ikiwiki security update
Debian DSA	DSA-3760-1	ikiwiki security update
EUVD	EUVD-2016-10447	ikiwiki before 3.20161229 incorrectly called the CGI::FormBuilder->field method (similar to the CGI->param API that led to Bugzilla's CVE-2014-1572), which can be abused to lead to commit metadata forgery.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://ikiwiki.info/security/#cve-2016-9646
https://marc.info/?l=oss-security&m=148304341511854&w=2
https://security-tracker.debian.org/tracker/CVE-2016-9646
https://www.debian.org/security/2017/dsa-3760

History

No history.

MITRE

Status: PUBLISHED

Assigner: debian

Published: 2018-04-13T15:00:00Z

Updated: 2024-09-16T16:53:21.398Z

Reserved: 2016-11-29T00:00:00

Link: CVE-2016-9646

Vulnrichment

No data.

NVD

Status : Modified

Published: 2018-04-13T15:29:00.210

Modified: 2024-11-21T03:01:34.190

Link: CVE-2016-9646

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "ikiwiki", "vendor": "ikiwiki", "versions": [{"status": "affected", "version": "before 3.20161229"}]}], "datePublic": "2016-12-29T00:00:00", "descriptions": [{"lang": "en", "value": "ikiwiki before 3.20161229 incorrectly called the CGI::FormBuilder->field method (similar to the CGI->param API that led to Bugzilla's CVE-2014-1572), which can be abused to lead to commit metadata forgery."}], "problemTypes": [{"descriptions": [{"description": "commit metadata forgery", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-04-13T14:57:02", "orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5", "shortName": "debian"}, "references": [{"name": "DSA-3760", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "https://www.debian.org/security/2017/dsa-3760"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://security-tracker.debian.org/tracker/CVE-2016-9646"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://ikiwiki.info/security/#cve-2016-9646"}, {"name": "[oss-security] 20161229 ikiwiki: CVE-2016-9645 (incomplete fix for CVE-2016-10026), CVE-2016-9646 (commit metadata forgery)", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://marc.info/?l=oss-security&m=148304341511854&w=2"}], "source": {"advisory": "https://ikiwiki.info/security/#cve-2016-9646", "discovery": "UNKNOWN"}, "title": "Commit metadata forgery via CGI::FormBuilder context-dependent APIs", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@debian.org", "DATE_PUBLIC": "2016-12-29T19:29:00.000Z", "ID": "CVE-2016-9646", "STATE": "PUBLIC", "TITLE": "Commit metadata forgery via CGI::FormBuilder context-dependent APIs"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "ikiwiki", "version": {"version_data": [{"version_value": "before 3.20161229"}]}}]}, "vendor_name": "ikiwiki"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "ikiwiki before 3.20161229 incorrectly called the CGI::FormBuilder->field method (similar to the CGI->param API that led to Bugzilla's CVE-2014-1572), which can be abused to lead to commit metadata forgery."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "commit metadata forgery"}]}]}, "references": {"reference_data": [{"name": "DSA-3760", "refsource": "DEBIAN", "url": "https://www.debian.org/security/2017/dsa-3760"}, {"name": "https://security-tracker.debian.org/tracker/CVE-2016-9646", "refsource": "CONFIRM", "url": "https://security-tracker.debian.org/tracker/CVE-2016-9646"}, {"name": "https://ikiwiki.info/security/#cve-2016-9646", "refsource": "CONFIRM", "url": "https://ikiwiki.info/security/#cve-2016-9646"}, {"name": "[oss-security] 20161229 ikiwiki: CVE-2016-9645 (incomplete fix for CVE-2016-10026), CVE-2016-9646 (commit metadata forgery)", "refsource": "MLIST", "url": "https://marc.info/?l=oss-security&m=148304341511854&w=2"}]}, "source": {"advisory": "https://ikiwiki.info/security/#cve-2016-9646", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T02:59:02.301Z"}, "title": "CVE Program Container", "references": [{"name": "DSA-3760", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "https://www.debian.org/security/2017/dsa-3760"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://security-tracker.debian.org/tracker/CVE-2016-9646"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://ikiwiki.info/security/#cve-2016-9646"}, {"name": "[oss-security] 20161229 ikiwiki: CVE-2016-9645 (incomplete fix for CVE-2016-10026), CVE-2016-9646 (commit metadata forgery)", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://marc.info/?l=oss-security&m=148304341511854&w=2"}]}]}, "cveMetadata": {"assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5", "assignerShortName": "debian", "cveId": "CVE-2016-9646", "datePublished": "2018-04-13T15:00:00Z", "dateReserved": "2016-11-29T00:00:00", "dateUpdated": "2024-09-16T16:53:21.398Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ikiwiki:ikiwiki:*:*:*:*:*:*:*:*", "matchCriteriaId": "D184243F-E174-4371-ABAE-460777B3CE19", "versionEndExcluding": "3.20161229", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*", "matchCriteriaId": "16F59A04-14CF-49E2-9973-645477EA09DA", "vulnerable": true}, {"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43", "vulnerable": true}, {"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "ikiwiki before 3.20161229 incorrectly called the CGI::FormBuilder->field method (similar to the CGI->param API that led to Bugzilla's CVE-2014-1572), which can be abused to lead to commit metadata forgery."}, {"lang": "es", "value": "ikiwiki, en versiones anteriores a la 3.20161229, llam\u00f3 incorrectamente al m\u00e9todo CGI::FormBuilder->field (similar a la API CGI->param que desemboc\u00f3 en el CVE-2014-1572 de Bugzilla), que puede aprovecharse para falsificar metadatos del commit."}], "id": "CVE-2016-9646", "lastModified": "2024-11-21T03:01:34.190", "metrics": {"cvssMetricV2": [{"acInsufInfo": true, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-04-13T15:29:00.210", "references": [{"source": "security@debian.org", "tags": ["Vendor Advisory"], "url": "https://ikiwiki.info/security/#cve-2016-9646"}, {"source": "security@debian.org", "tags": ["Third Party Advisory"], "url": "https://marc.info/?l=oss-security&m=148304341511854&w=2"}, {"source": "security@debian.org", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://security-tracker.debian.org/tracker/CVE-2016-9646"}, {"source": "security@debian.org", "tags": ["Third Party Advisory"], "url": "https://www.debian.org/security/2017/dsa-3760"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://ikiwiki.info/security/#cve-2016-9646"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://marc.info/?l=oss-security&m=148304341511854&w=2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://security-tracker.debian.org/tracker/CVE-2016-9646"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://www.debian.org/security/2017/dsa-3760"}], "sourceIdentifier": "security@debian.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "nvd@nist.gov", "type": "Primary"}]}