{"id":"MGASA-2015-0093","summary":"Updated dokuwiki packages fix CVE-2015-2172","details":"Updated dokuwiki package fixes security vulnerability:\n\nDokuWiki before 20140929c has a security issue in the ACL plugins remote API\ncomponent. The plugin failed to check for superuser permissions before\nexecuting ACL addition or deletion. This means everybody with permissions to\ncall the XMLRPC API also had permissions to set up their own ACL rules and thus\ncircumventing any existing rules (CVE-2015-2172).\n","modified":"2026-04-16T06:25:16.949948595Z","published":"2015-03-05T19:34:09Z","upstream":["CVE-2015-2172"],"references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2015-0093.html"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=15402"},{"type":"REPORT","url":"https://github.com/splitbrain/dokuwiki/issues/1056"},{"type":"WEB","url":"https://www.dokuwiki.org/changes#release_2014-09-29c_hrun"}],"affected":[{"package":{"name":"dokuwiki","ecosystem":"Mageia:4","purl":"pkg:rpm/mageia/dokuwiki?arch=source&distro=mageia-4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20140929-1.3.mga4"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2015-0093.json"}}],"schema_version":"1.7.5","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}