Description

Unauthenticated users can execute arbitrary code do to a vulnerability in the Calendar module.

Remediation

Upgrade Tiki Wiki CMS to version 14.2, 12.5 LTS, 9.11 LTS, 6.15 or above (recommended). If that is not possible, disable the calendar feature, or at the very minimum make the calendar feature accessible only to trusted users.

References

Tiki Wiki Announcement (2016-01-24)

Related Vulnerabilities

Delve Debugger Unauthorized Access Vulnerability

Microsoft Frontpage configuration information

VMware vCenter vcavbootstrap Arbitrary File Read

Laravel LogViewer open

WordPress Plugin WooCommerce Information Disclosure (4.5.2)

Severity

High

Classification

CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H/E:H/RL:O/RC:C CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Information Disclosure Code Execution