CVE-2008-0169 Plugin/passwordauth.pm (aka the passwordauth plugin) in ikiwiki 1.34 through 2.47 allows remote attackers to bypass authentication, and login to any account for which an OpenID identity is configured....
MediumCVSS 6.8
EPSS 1.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Plugin/passwordauth.pm (aka the passwordauth plugin) in ikiwiki 1.34 through 2.47 allows remote attackers to bypass authentication, and login to any account for which an OpenID identity is configured and a password is not configured, by specifying an empty password during the login sequence.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ikiwiki | = 1.5 | No fix listed |
| ikiwiki | = 1.34 | No fix listed |
| ikiwiki | = 1.34.1 | No fix listed |
| ikiwiki | = 1.34.2 | No fix listed |
| ikiwiki | = 1.35 | No fix listed |
| ikiwiki | = 1.36 | No fix listed |
| ikiwiki | = 1.37 | No fix listed |
| ikiwiki | = 1.38 | No fix listed |
| ikiwiki | = 1.39 | No fix listed |
| ikiwiki | = 1.40 | No fix listed |
| ikiwiki | = 1.41 | No fix listed |
| ikiwiki | = 1.42 | No fix listed |
| ikiwiki | = 1.43 | No fix listed |
| ikiwiki | = 1.44 | No fix listed |
| ikiwiki | = 1.45 | No fix listed |
| ikiwiki | = 1.46 | No fix listed |
| ikiwiki | = 1.47 | No fix listed |
| ikiwiki | = 1.48 | No fix listed |
| ikiwiki | = 1.49 | No fix listed |
| ikiwiki | = 1.51 | No fix listed |
| ikiwiki | = 2.0 | No fix listed |
| ikiwiki | = 2.1 | No fix listed |
| ikiwiki | = 2.2 | No fix listed |
| ikiwiki | = 2.3 | No fix listed |
| ikiwiki | = 2.4 | No fix listed |
Show 30 more
| Product | Affected versions | Fixed in |
|---|---|---|
| ikiwiki | = 2.5 | No fix listed |
| ikiwiki | = 2.6 | No fix listed |
| ikiwiki | = 2.7 | No fix listed |
| ikiwiki | = 2.8 | No fix listed |
| ikiwiki | = 2.9 | No fix listed |
| ikiwiki | = 2.10 | No fix listed |
| ikiwiki | = 2.11 | No fix listed |
| ikiwiki | = 2.12 | No fix listed |
| ikiwiki | = 2.13 | No fix listed |
| ikiwiki | = 2.14 | No fix listed |
| ikiwiki | = 2.15 | No fix listed |
| ikiwiki | = 2.16 | No fix listed |
| ikiwiki | = 2.17 | No fix listed |
| ikiwiki | = 2.18 | No fix listed |
| ikiwiki | = 2.19 | No fix listed |
| ikiwiki | = 2.20 | No fix listed |
| ikiwiki | = 2.30 | No fix listed |
| ikiwiki | = 2.31 | No fix listed |
| ikiwiki | = 2.31.1 | No fix listed |
| ikiwiki | = 2.31.2 | No fix listed |
| ikiwiki | = 2.31.3 | No fix listed |
| ikiwiki | = 2.40 | No fix listed |
| ikiwiki | = 2.41 | No fix listed |
| ikiwiki | = 2.42 | No fix listed |
| ikiwiki | = 2.43 | No fix listed |
| ikiwiki | = 2.44 | No fix listed |
| ikiwiki | = 2.47 | No fix listed |
| debian/ikiwiki(Debian:12) | < 2.48 | 2.48 |
| debian/ikiwiki(Debian:13) | < 2.48 | 2.48 |
| debian/ikiwiki(Debian:14) | < 2.48 | 2.48 |
References
- bugs.debian.org
- ikiwiki.info
- ikiwiki.info
- 30468 third-party-advisory vendor-advisory
- [oss-security] 20080531 Re: CVE id request: ikiwiki mailing-list
- 29479 vdb-entry
- ADV-2008-1710 vdb-entry
- ikiwiki-openid-passwordauth-auth-bypass(42798) vdb-entry
- Debian Security Tracker CVE-2008-0169 vendor-advisory
- bugs.debian.org issue-tracking