CVE-2016-9646 PUBLISHED

ikiwiki before 3.20161229 incorrectly called the CGI::FormBuilder->field method (similar to the CGI->param API that led to Bugzilla's CVE-2014-1572), which can be abused to lead to commit metadata forgery.

EPSS 0.26% · 49.4th percentile

Risk Scores

EPSS Score
0.26%
49.4th percentile

Affected Products

VendorProductVersions
Ubuntu:16.04:LTSikiwiki0, 3.20150614, 3.20160121

Timeline

References

Open in Interactive Console →