{"id":"CVE-2015-2172","aliases":["DEBIAN-CVE-2015-2172","EUVD-2015-2280","GHSA-8xqm-cgj8-jqmr","MGASA-2015-0093","UBUNTU-CVE-2015-2172"],"status":"published","title":"DokuWiki before 2014-05-05d and before 2014-09-29c does not properly check permissions for the...","description":"DokuWiki before 2014-05-05d and before 2014-09-29c does not properly check permissions for the ACL plugins, which allows remote authenticated users to gain privileges and add or delete ACL rules via a request to the XMLRPC API.","severity":{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.02862,"percentile":0.86841,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284"],"published":"2015-03-05T19:34:09Z","modified":"2026-09-09T06:47:22Z","fixes":[{"ecosystem":"Debian:12","package":"dokuwiki","fixed_in":["0.0.20140929.d-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"dokuwiki","fixed_in":["0.0.20140929.d-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dokuwiki","fixed_in":["0.0.20140929.d-1"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"dokuwiki","fixed_in":["20140929-1.3.mga4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"dokuwiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20140929.d-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"dokuwiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20140929.d-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"dokuwiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20140929.d-1"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"dokuwiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20140929-1.3.mga4"}]}]}],"products":[{"vendor":"dokuwiki","product":"dokuwiki"}],"references":[{"url":"https://github.com/splitbrain/dokuwiki/issues/1056","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","report"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153266.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"https://github.com/splitbrain/dokuwiki/commit/4970ad24ce49ec76a0ee67bca7594f918ced2f5f","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.dokuwiki.org/changes","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/72827","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153062.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152994.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www.openwall.com/lists/oss-security/2015/03/02/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://advisories.mageia.org/MGASA-2015-0093.html","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-2172"},{"url":"https://github.com/advisories/GHSA-8xqm-cgj8-jqmr"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-2172","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0093.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15402","tags":["report"]},{"url":"https://www.dokuwiki.org/changes#release_2014-09-29c_hrun","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-2172","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-2172","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-2172","description":"DokuWiki before 2014-05-05d and before 2014-09-29c does not properly check permissions for the ACL plugins, which allows remote authenticated users to gain privileges and add or delete ACL rules via a request to the XMLRPC API.","status":"published","published":"2015-03-30T14:00:00Z","modified":"2024-08-06T05:10:14.457Z","updated_at":"2026-11-02T14:35:41.621934Z"}],"euvd":[{"id":"EUVD-2015-2280","description":"DokuWiki before 2014-05-05d and before 2014-09-29c does not properly check permissions for the ACL plugins, which allows remote authenticated users to gain privileges and add or delete ACL rules via a request to the XMLRPC API.","status":"published","published":"2015-03-30T14:00:00Z","modified":"2024-08-06T05:10:14Z","updated_at":"2026-11-03T02:22:12.830256Z"}],"ghsa":[{"id":"GHSA-8xqm-cgj8-jqmr","title":"DokuWiki before 2014-05-05d and before 2014-09-29c does not properly check permissions for the...","description":"DokuWiki before 2014-05-05d and before 2014-09-29c does not properly check permissions for the ACL plugins, which allows remote authenticated users to gain privileges and add or delete ACL rules via a request to the XMLRPC API.","status":"published","published":"2022-05-14T01:36:40Z","modified":"2023-02-02T05:04:22Z","cwes":["CWE-284"],"updated_at":"2026-11-02T14:51:51.17086Z"}],"nvd":[{"id":"CVE-2015-2172","description":"DokuWiki before 2014-05-05d and before 2014-09-29c does not properly check permissions for the ACL plugins, which allows remote authenticated users to gain privileges and add or delete ACL rules via a request to the XMLRPC API.","status":"published","published":"2015-03-30T14:59:07.07Z","modified":"2026-06-17T00:23:42.507Z","cvss":[{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:03:03.313464Z"}],"osv":[{"id":"CVE-2015-2172","description":"DokuWiki before 2014-05-05d and before 2014-09-29c does not properly check permissions for the ACL plugins, which allows remote authenticated users to gain privileges and add or delete ACL rules via a request to the XMLRPC API.","status":"published","published":"2015-03-30T14:59:07Z","modified":"2026-04-16T06:26:07.685167456Z","updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-2172","description":"DokuWiki before 2014-05-05d and before 2014-09-29c does not properly check permissions for the ACL plugins, which allows remote authenticated users to gain privileges and add or delete ACL rules via a request to the XMLRPC API.","status":"published","published":"2015-03-30T14:59:07.07Z","modified":"2026-09-09T06:47:22.022517005Z","updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"MGASA-2015-0093","title":"Updated dokuwiki packages fix CVE-2015-2172","description":"Updated dokuwiki package fixes security vulnerability:\n\nDokuWiki before 20140929c has a security issue in the ACL plugins remote API\ncomponent. The plugin failed to check for superuser permissions before\nexecuting ACL addition or deletion. This means everybody with permissions to\ncall the XMLRPC API also had permissions to set up their own ACL rules and thus\ncircumventing any existing rules (CVE-2015-2172).\n","status":"published","published":"2015-03-05T19:34:09Z","modified":"2026-04-16T06:25:16.949948595Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"UBUNTU-CVE-2015-2172","description":"DokuWiki before 2014-05-05d and before 2014-09-29c does not properly check permissions for the ACL plugins, which allows remote authenticated users to gain privileges and add or delete ACL rules via a request to the XMLRPC API.","status":"withdrawn","published":"2015-03-30T14:59:00Z","modified":"2025-07-16T08:11:26.270308Z","updated_at":"2026-11-02T15:54:10.045446Z"}]}}