CVE-2017-0356

Authentication bypass via repeated parameters

9.8 CriticalFix available

A flaw, similar to to CVE-2016-9646, exists in ikiwiki before 3.20170111, in the passwordauth plugin's use of CGI::FormBuilder, allowing an attacker to bypass authentication via repeated parameters.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

3.28%Up 2.2 points since Apr 14, 2021

What each source reports

NVD Score used 9.8

A flaw, similar to to CVE-2016-9646, exists in ikiwiki before 3.20170111, in the passwordauth plugin's use of CGI::FormBuilder, allowing an attacker to bypass authentication via repeated parameters.

Record: CVE-2017-0356
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-287
Updated: 2026-11-02

CVE List No score

Authentication bypass via repeated parameters

A flaw, similar to to CVE-2016-9646, exists in ikiwiki before 3.20170111, in the passwordauth plugin's use of CGI::FormBuilder, allowing an attacker to bypass authentication via repeated parameters.

Record: CVE-2017-0356
Updated: 2026-11-02

EUVDEUVD-2017-0712 No score

A flaw, similar to to CVE-2016-9646, exists in ikiwiki before 3.20170111, in the passwordauth plugin's use of CGI::FormBuilder, allowing an attacker to bypass authentication via repeated parameters.

Record: EUVD-2017-0712
Updated: 2026-11-03

GitHub AdvisoriesGHSA-v4mw-26wf-pfx6 9.8

A flaw, similar to to CVE-2016-9646, exists in ikiwiki before 3.20170111, in the passwordauth...

A flaw, similar to to CVE-2016-9646, exists in ikiwiki before 3.20170111, in the passwordauth plugin's use of CGI::FormBuilder, allowing an attacker to bypass authentication via repeated parameters.

Record: GHSA-v4mw-26wf-pfx6
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-287
Updated: 2026-11-02

OSV 9.8

A flaw, similar to to CVE-2016-9646, exists in ikiwiki before 3.20170111, in the passwordauth plugin's use of CGI::FormBuilder, allowing an attacker to bypass authentication via repeated parameters.

Record: CVE-2017-0356
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2017-0356 9.8

A flaw, similar to to CVE-2016-9646, exists in ikiwiki before 3.20170111, in the passwordauth plugin's use of CGI::FormBuilder, allowing an attacker to bypass authentication via repeated parameters.

Record: DEBIAN-CVE-2017-0356
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2017-0356 9.8

A flaw, similar to to CVE-2016-9646, exists in ikiwiki before 3.20170111, in the passwordauth plugin's use of CGI::FormBuilder, allowing an attacker to bypass authentication via repeated parameters.

Record: UBUNTU-CVE-2017-0356
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVMGASA-2019-0113 No score

Updated ikiwiki packages fix security vulnerability

Several security issues identified in ikiwiki fixed by updating to version 3.20190228. See references for details

Record: MGASA-2019-0113
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10860-1 No score

ikiwiki-3.20200202.3-2.7 on GA media

These are all security issues fixed in the ikiwiki-3.20200202.3-2.7 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10860-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`ikiwiki` Debian:12	before 3.20170111	3.20170111
`ikiwiki` Debian:13	before 3.20170111	3.20170111
`ikiwiki` Debian:14	before 3.20170111	3.20170111
`ikiwiki` Debian:7	before 3.20120629.2+deb7u2, plus listed versions 3.201206293.20120629.13.20120629.23.20120629.2+deb7u1	3.20120629.2+deb7u2
`ikiwiki` Debian:8	before 3.20141016.4, plus listed versions 3.20141016.23.20141016.3	3.20141016.4
`ikiwiki` Mageia:6	before 3.20190228-1.1.mga6	3.20190228-1.1.mga6
`ikiwiki` Ubuntu:16.04:LTS	All versions, plus listed versions 3.201506143.20160121	None known
`ikiwiki` openSUSE:Tumbleweed	before 3.20200202.3-2.7	3.20200202.3-2.7

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-0356 is a critical vulnerability (CVSS 9.8) in Ikiwiki, published January 12, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.28%, the 88th percentile. Fixed in ikiwiki 3.20170111.

References

Show 24 moreShow less