Evil-DB LogoEvil-DB
← All CVEs

CVE-2010-0288

high · 7.5

A typo in the administrator permission check in the ACL Manager plugin (plugins/acl/ajax.php) in DokuWiki before 2009-12-25b allows remote attackers to gain privileges and access closed wikis by editing current ACL statements, as demonstrated in the wild in January 2010.

7.5
CVSS
10.5%
EPSS (exploit prob.)
96th
EPSS percentile
2010-02-15
Published

AV:N/AC:L/Au:N/C:P/I:P/A:P

Weaknesses

CWE-264

Affected products

VendorProductAffected versions
dokuwikidokuwiki<= release_2009-02-14
dokuwikidokuwiki2004-07-04
dokuwikidokuwiki2004-07-07
dokuwikidokuwiki2004-07-12
dokuwikidokuwiki2004-07-21
dokuwikidokuwiki2004-07-25
dokuwikidokuwiki2004-08-08
dokuwikidokuwiki2004-08-15a
dokuwikidokuwiki2004-08-22
dokuwikidokuwiki2004-09-12
dokuwikidokuwiki2004-09-25
dokuwikidokuwiki2004-09-30
dokuwikidokuwiki2004-11-01
dokuwikidokuwiki2004-11-02
dokuwikidokuwiki2004-11-10
dokuwikidokuwiki2005-01-14
dokuwikidokuwiki2005-01-15
dokuwikidokuwiki2005-01-16a
dokuwikidokuwiki2005-02-06
dokuwikidokuwiki2005-02-18
dokuwikidokuwiki2005-05-07
dokuwikidokuwiki2005-07-01
dokuwikidokuwiki2005-07-13
dokuwikidokuwiki2005-09-19
dokuwikidokuwiki2005-09-22
dokuwikidokuwiki2006-03-05
dokuwikidokuwiki2006-03-09
dokuwikidokuwiki2006-03-09e
dokuwikidokuwiki2006-06-04

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2010-0288