Description
Plugin/passwordauth.pm (aka the passwordauth plugin) in ikiwiki 1.34 through 2.47 allows remote attackers to bypass authentication, and login to any account for which an OpenID identity is configured and a password is not configured, by specifying an empty password during the login sequence.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://secunia.com/advisories/30468 ↗
- http://www.vupen.com/english/advisories/2008/1710 ↗
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=483770 ↗
- http://www.openwall.com/lists/oss-security/2008/05/31/3 ↗
- https://exchange.xforce.ibmcloud.com/vulnerabilities/42798 ↗
- http://ikiwiki.info/news/version_2.48/index.html ↗
- http://www.securityfocus.com/bid/29479 ↗
- http://ikiwiki.info/security/#index33h2 ↗