CVE-2017-14924

High

Published: 30/09/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

In Tiki before 16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, and 15 LTS before 15.5 LTS, there is a CSRF vulnerability that allows an authenticated user to gain administrator privileges if an administrator opens a wiki page with an IMG element related to tiki-assignuser.php.

Risk Assessment

This vulnerability poses a risk of unauthorized elevation of administrator privileges, potentially leading to serious security breaches within the system.

Recommendation

It is recommended to update Tiki to the latest version to mitigate this vulnerability and implement additional protections against CSRF attacks.

Other vulnerabilities in Tiki

CVE-2017-14925High
In Tiki before 16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, and 15 LTS before 15.5 LTS, there is a CSRF vulnerability that allows an authenticated user to edit global permissions. An attacker could exploit an IMG element on a wiki page opened by an administrator to assign administrator privileges to every unauthenticated user.

Original NVD description (English source)

Cross-Site Request Forgery (CSRF) vulnerability via IMG element in Tiki before 16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, and 15 LTS before 15.5 LTS allows an authenticated user to gain administrator privileges if an administrator opens a wiki page with an IMG element, related to tiki-assignuser.php.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS