CVE-2017-14925

High

Published: 30/09/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

In Tiki before 16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, and 15 LTS before 15.5 LTS, there is a CSRF vulnerability that allows an authenticated user to edit global permissions. An attacker could exploit an IMG element on a wiki page opened by an administrator to assign administrator privileges to every unauthenticated user.

Risk Assessment

This vulnerability poses a serious security risk as it can lead to unauthorized granting of administrative privileges, jeopardizing the integrity of the system.

Recommendation

It is recommended to update Tiki to the latest version to eliminate this vulnerability and implement additional safeguards against CSRF attacks.

Other vulnerabilities in Tiki

CVE-2017-14924High
In Tiki before 16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, and 15 LTS before 15.5 LTS, there is a CSRF vulnerability that allows an authenticated user to gain administrator privileges if an administrator opens a wiki page with an IMG element related to tiki-assignuser.php.

Original NVD description (English source)

Cross-Site Request Forgery (CSRF) vulnerability via IMG element in Tiki before 16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, and 15 LTS before 15.5 LTS allows an authenticated user to edit global permissions if an administrator opens a wiki page with an IMG element, related to tiki-objectpermissions.php. For example, an attacker could assign administrator privileges to every unauthenticated user of the site.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS