CVE-2016-9646

Commit metadata forgery via CGI::FormBuilder context-dependent APIs

State: Published
Severity: Not scored
Published: Apr 13, 2018
Updated: Sep 16, 2024
Reserved: Nov 29, 2016

Description

ikiwiki before 3.20161229 incorrectly called the CGI::FormBuilder->field method (similar to the CGI->param API that led to Bugzilla's CVE-2014-1572), which can be abused to lead to commit metadata forgery.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
ikiwikiikiwiki	before 3.20161229Affected

References

DSA-3760vendor-advisory
https://security-tracker.debian.org/tracker/CVE-2016-9646
https://ikiwiki.info/security/#cve-2016-9646
[oss-security] 20161229 ikiwiki: CVE-2016-9645 (incomplete fix for CVE-2016-10026), CVE-2016-9646 (commit metadata forgery)mailing-list

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.