CVE-2015-2172
DokuWiki before 2014-05-05d and before 2014-09-29c does not properly check permissions for the...
CVE-2015-2172 is a medium vulnerability (CVSS 6.5) in Dokuwiki, published March 5, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.86%, the 86th percentile. Fixed in dokuwiki 0.0.20140929.d-1.
- Severity
- 6.5 MediumCVSS 2.0, NVD
- Exploit chance
- 2.86%EPSS, 86th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.0.20140929.d-1dokuwiki +3 more
Description
DokuWiki before 2014-05-05d and before 2014-09-29c does not properly check permissions for the ACL plugins, which allows remote authenticated users to gain privileges and add or delete ACL rules via a request to the XMLRPC API.
Exploit likelihood
Affected products
Affected packages
What each source reports
NVD Score used
DokuWiki before 2014-05-05d and before 2014-09-29c does not properly check permissions for the ACL plugins, which allows remote authenticated users to gain privileges and add or delete ACL rules via a request to the XMLRPC API.
- Record
CVE-2015-2172- CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-284
- Updated
- 2026-11-02
CVE ListNo score
DokuWiki before 2014-05-05d and before 2014-09-29c does not properly check permissions for the ACL plugins, which allows remote authenticated users to gain privileges and add or delete ACL rules via a request to the XMLRPC API.
- Record
CVE-2015-2172- Updated
- 2026-11-02
EUVDEUVD-2015-2280No score
DokuWiki before 2014-05-05d and before 2014-09-29c does not properly check permissions for the ACL plugins, which allows remote authenticated users to gain privileges and add or delete ACL rules via a request to the XMLRPC API.
- Record
EUVD-2015-2280- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8xqm-cgj8-jqmrNo score
DokuWiki before 2014-05-05d and before 2014-09-29c does not properly check permissions for the...
DokuWiki before 2014-05-05d and before 2014-09-29c does not properly check permissions for the ACL plugins, which allows remote authenticated users to gain privileges and add or delete ACL rules via a request to the XMLRPC API.
- Record
GHSA-8xqm-cgj8-jqmr- Weakness
- CWE-284
- Updated
- 2026-11-02
OSVNo score
DokuWiki before 2014-05-05d and before 2014-09-29c does not properly check permissions for the ACL plugins, which allows remote authenticated users to gain privileges and add or delete ACL rules via a request to the XMLRPC API.
- Record
CVE-2015-2172- Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-2172No score
DokuWiki before 2014-05-05d and before 2014-09-29c does not properly check permissions for the ACL plugins, which allows remote authenticated users to gain privileges and add or delete ACL rules via a request to the XMLRPC API.
- Record
DEBIAN-CVE-2015-2172- Updated
- 2026-11-02
OSVMGASA-2015-0093No score
Updated dokuwiki packages fix CVE-2015-2172
Updated dokuwiki package fixes security vulnerability:
DokuWiki before 20140929c has a security issue in the ACL plugins remote API component. The plugin failed to check for superuser permissions before executing ACL addition or deletion. This means everybody with permissions to call the XMLRPC API also had permissions to set up their own ACL rules and thus circumventing any existing rules (CVE-2015-2172).
- Record
MGASA-2015-0093- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-2172No score
DokuWiki before 2014-05-05d and before 2014-09-29c does not properly check permissions for the ACL plugins, which allows remote authenticated users to gain privileges and add or delete ACL rules via a request to the XMLRPC API.
- Record
UBUNTU-CVE-2015-2172- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/splitbrain/dokuwiki/issues/1056
lists.fedoraproject.org/pipermail/package-announce/2015-March/153266.html
dokuwiki.org/changes
securityfocus.com/bid/72827
Show 9 moreShow less
openwall.com/lists/oss-security/2015/03/02/2
advisories.mageia.org/MGASA-2015-0093.html
nvd.nist.gov/vuln/detail/CVE-2015-2172
security-tracker.debian.org/tracker/CVE-2015-2172
bugs.mageia.org/show_bug.cgi?id=15402
ubuntu.com/security/CVE-2015-2172
cve.org/CVERecord?id=CVE-2015-2172