CVE-2016-9645 Editing restriction bypass for git revert

Medium 6.5 Published 10 Apr 2018 Updated 16 Sep 2024

Attackers can bypass editing restrictions in ikiwiki by exploiting git revert functionality when using older git versions.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2016-9645?

CVE-2016-9645 is a medium-severity vulnerability in ikiwiki, published on 10 Apr 2018. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The fix for ikiwiki for CVE-2016-10026 was incomplete resulting in editing restriction bypass for git revert when using git versions older than 2.8.0. This has been fixed in 3.20161229.

Weakness: CWE-284

Which versions are affected by CVE-2016-9645?

It affects 1 product.

Products include Ikiwiki Ikiwiki.

How do I fix CVE-2016-9645?

Upgrade to a fixed version.

Is CVE-2016-9645 being exploited?

There is no known exploitation of CVE-2016-9645 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2016-9645, GHSA-4xrj-353q-c3p7, UBUNTU-CVE-2016-9645.