CVE-2010-0288
A typo in the administrator permission check in the ACL Manager plugin (plugins/acl/ajax.php) in...
A typo in the administrator permission check in the ACL Manager plugin (plugins/acl/ajax.php) in DokuWiki before 2009-12-25b allows remote attackers to gain privileges and access closed wikis by editing current ACL statements, as demonstrated in the wild in January 2010.
Exploit likelihood
What each source reports
NVD Score used
A typo in the administrator permission check in the ACL Manager plugin (plugins/acl/ajax.php) in DokuWiki before 2009-12-25b allows remote attackers to gain privileges and access closed wikis by editing current ACL statements, as demonstrated in the wild in January 2010.
- Record
CVE-2010-0288- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
A typo in the administrator permission check in the ACL Manager plugin (plugins/acl/ajax.php) in DokuWiki before 2009-12-25b allows remote attackers to gain privileges and access closed wikis by editing current ACL statements, as demonstrated in the wild in January 2010.
- Record
CVE-2010-0288- Updated
- 2026-11-02
EUVDEUVD-2010-0319 No score
A typo in the administrator permission check in the ACL Manager plugin (plugins/acl/ajax.php) in DokuWiki before 2009-12-25b allows remote attackers to gain privileges and access closed wikis by editing current ACL statements, as demonstrated in the wild in January 2010.
- Record
EUVD-2010-0319- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fx5h-623c-jvh7 No score
A typo in the administrator permission check in the ACL Manager plugin (plugins/acl/ajax.php) in...
A typo in the administrator permission check in the ACL Manager plugin (plugins/acl/ajax.php) in DokuWiki before 2009-12-25b allows remote attackers to gain privileges and access closed wikis by editing current ACL statements, as demonstrated in the wild in January 2010.
- Record
GHSA-fx5h-623c-jvh7- Updated
- 2026-11-02
OSV No score
A typo in the administrator permission check in the ACL Manager plugin (plugins/acl/ajax.php) in DokuWiki before 2009-12-25b allows remote attackers to gain privileges and access closed wikis by editing current ACL statements, as demonstrated in the wild in January 2010.
- Record
CVE-2010-0288- Updated
- 2026-11-02
OSVDEBIAN-CVE-2010-0288 No score
A typo in the administrator permission check in the ACL Manager plugin (plugins/acl/ajax.php) in DokuWiki before 2009-12-25b allows remote attackers to gain privileges and access closed wikis by editing current ACL statements, as demonstrated in the wild in January 2010.
- Record
DEBIAN-CVE-2010-0288- Updated
- 2026-11-02
OSVUBUNTU-CVE-2010-0288 No score
A typo in the administrator permission check in the ACL Manager plugin (plugins/acl/ajax.php) in DokuWiki before 2009-12-25b allows remote attackers to gain privileges and access closed wikis by editing current ACL statements, as demonstrated in the wild in January 2010.
- Record
UBUNTU-CVE-2010-0288- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dokuwikiDebian:12 |
before 0.0.20090214b-3.1 | 0.0.20090214b-3.1 |
dokuwikiDebian:13 |
before 0.0.20090214b-3.1 | 0.0.20090214b-3.1 |
dokuwikiDebian:14 |
before 0.0.20090214b-3.1 | 0.0.20090214b-3.1 |
dokuwikiDebian:5.0 From an advisory covering 3 CVEs |
before 0.0.20080505-4+lenny1, plus listed versions 0.0.20080505-4 |
0.0.20080505-4+lenny1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | dokuwiki 2009-12-25 - Multiple Vulnerabilities | 2010-01-14 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2010-0288 is a high vulnerability (CVSS 7.5) in Dokuwiki, published January 22, 2010. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 10.7%, the 95th percentile. Fixed in dokuwiki 0.0.20090214b-3.1.
References
exchange.xforce.ibmcloud.com/vulnerabilities/55661
osvdb.org/61710
lists.fedoraproject.org/pipermail/package-announce/2010-February/034729.html
secunia.com/advisories/38183
security.gentoo.org/glsa/glsa-201301-07.xml
vupen.com/english/advisories/2010/0150
Show 11 moreShow less
splitbrain.org/blog/2010-01/17-dokuwiki-security
debian.org/security/2010/dsa-1976
securityfocus.com/bid/37820
bugs.splitbrain.org/index.php?do=details&task_id=1847
exploit-db.com/exploits/11141
nvd.nist.gov/vuln/detail/CVE-2010-0288
github.com/advisories/GHSA-fx5h-623c-jvh7
security-tracker.debian.org/tracker/CVE-2010-0288
ubuntu.com/security/CVE-2010-0288
cve.org/CVERecord?id=CVE-2010-0288