Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2016-9646

Commit metadata forgery via CGI::FormBuilder context-dependent APIs

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
debian

Description

ikiwiki before 3.20161229 incorrectly called the CGI::FormBuilder->field method (similar to the CGI->param API that led to Bugzilla's CVE-2014-1572), which can be abused to lead to commit metadata forgery.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ikiwiki ikiwiki

  • before 3.20161229affected

References