CVE-2016-9645
Editing restriction bypass for git revert
The fix for ikiwiki for CVE-2016-10026 was incomplete resulting in editing restriction bypass for git revert when using git versions older than 2.8.0. This has been fixed in 3.20161229.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The fix for ikiwiki for CVE-2016-10026 was incomplete resulting in editing restriction bypass for git revert when using git versions older than 2.8.0. This has been fixed in 3.20161229.
- Record
CVE-2016-9645- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:N/I:P/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
CVE List No score
Editing restriction bypass for git revert
The fix for ikiwiki for CVE-2016-10026 was incomplete resulting in editing restriction bypass for git revert when using git versions older than 2.8.0. This has been fixed in 3.20161229.
- Record
CVE-2016-9645- Updated
- 2026-11-02
EUVDEUVD-2016-10446 No score
The fix for ikiwiki for CVE-2016-10026 was incomplete resulting in editing restriction bypass for git revert when using git versions older than 2.8.0. This has been fixed in 3.20161229.
- Record
EUVD-2016-10446- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4xrj-353q-c3p7
The fix for ikiwiki for CVE-2016-10026 was incomplete resulting in editing restriction bypass for...
The fix for ikiwiki for CVE-2016-10026 was incomplete resulting in editing restriction bypass for git revert when using git versions older than 2.8.0. This has been fixed in 3.20161229.
- Record
GHSA-4xrj-353q-c3p7- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
OSV
The fix for ikiwiki for CVE-2016-10026 was incomplete resulting in editing restriction bypass for git revert when using git versions older than 2.8.0. This has been fixed in 3.20161229.
- Record
CVE-2016-9645- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-9645
The fix for ikiwiki for CVE-2016-10026 was incomplete resulting in editing restriction bypass for git revert when using git versions older than 2.8.0. This has been fixed in 3.20161229.
- Record
DEBIAN-CVE-2016-9645- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-9645
The fix for ikiwiki for CVE-2016-10026 was incomplete resulting in editing restriction bypass for git revert when using git versions older than 2.8.0. This has been fixed in 3.20161229.
- Record
UBUNTU-CVE-2016-9645- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVMGASA-2019-0113 No score
Updated ikiwiki packages fix security vulnerability
Several security issues identified in ikiwiki fixed by updating to version 3.20190228. See references for details
- Record
MGASA-2019-0113- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10860-1 No score
ikiwiki-3.20200202.3-2.7 on GA media
These are all security issues fixed in the ikiwiki-3.20200202.3-2.7 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10860-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ikiwikiDebian:12 |
before 3.20161229 | 3.20161229 |
ikiwikiDebian:13 |
before 3.20161229 | 3.20161229 |
ikiwikiDebian:14 |
before 3.20161229 | 3.20161229 |
ikiwikiMageia:6 From an advisory covering 6 CVEs |
before 3.20190228-1.1.mga6 | 3.20190228-1.1.mga6 |
ikiwikiUbuntu:16.04:LTS |
All versions, plus listed versions 3.201506143.20160121 |
None known |
ikiwikiopenSUSE:Tumbleweed From an advisory covering 14 CVEs |
before 3.20200202.3-2.7 | 3.20200202.3-2.7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-9645 is a medium vulnerability (CVSS 6.5) in Ikiwiki, published April 10, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.91%, the 60th percentile. Fixed in ikiwiki 3.20161229.
References
security-tracker.debian.org/tracker/CVE-2016-9645
ikiwiki.info/security
marc.info?l=oss-security&m=148304341511854&w=2
nvd.nist.gov/vuln/detail/CVE-2016-9645
github.com/advisories/GHSA-4xrj-353q-c3p7
advisories.mageia.org/MGASA-2019-0113.html
Show 23 moreShow less
bugs.mageia.org/show_bug.cgi?id=24453
openwall.com/lists/oss-security/2019/02/28/1
debian.org/security/2019/dsa-4399
ubuntu.com/security/CVE-2016-9645
cve.org/CVERecord?id=CVE-2016-9645
suse.com/security/cve/CVE-2008-0169