Description

Unauthenticated users can execute arbitrary code do to a vulnerability in the Calendar module.

Remediation

Upgrade Tiki Wiki CMS to version 14.2, 12.5 LTS, 9.11 LTS, 6.15 or above (recommended). If that is not possible, disable the calendar feature, or at the very minimum make the calendar feature accessible only to trusted users.

References

Tiki Wiki Announcement (2016-01-24)

Related Vulnerabilities

WordPress Plugin WP Marketplace-Complete Shopping Cart/eCommerce Solution Arbitrary File Download (2.4.0)

WordPress Plugin Salon Booking System Multiple Information Disclosure Vulnerabilities (7.6.2)

WordPress Plugin Customize WordPress Emails and Alerts-Better Notifications for WP Information Disclosure (1.8.6)

WordPress Plugin Import all XML, CSV & TXT into WordPress Arbitrary File Disclosure (3.7)

ZK Framework AuUploader Information Disclosure (CVE-2022-36537)

Severity

High

Classification

CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H/E:H/RL:O/RC:C CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Information Disclosure Code Execution