CVE-2015-2172

DokuWiki before 2014-05-05d and before 2014-09-29c does not properly check permissions for the ACL plugins, which allows remote authenticated users to gain privileges and add or delete ACL rules via a request to the XMLRPC API.

• CWE-284

• http://advisories.mageia.org/MGASA-2015-0093.htmlThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152994.htmlMailing List, Third Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153062.htmlMailing List, Third Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153266.htmlMailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2015/03/02/2Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/72827Third Party Advisory, VDB Entry
• https://github.com/splitbrain/dokuwiki/commit/4970ad24ce49ec76a0ee67bca7594f918ced2f5fThird Party Advisory
• https://github.com/splitbrain/dokuwiki/issues/1056Third Party Advisory
• https://www.dokuwiki.org/changesVendor Advisory
• http://advisories.mageia.org/MGASA-2015-0093.htmlThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152994.htmlMailing List, Third Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153062.htmlMailing List, Third Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153266.htmlMailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2015/03/02/2Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/72827Third Party Advisory, VDB Entry
• https://github.com/splitbrain/dokuwiki/commit/4970ad24ce49ec76a0ee67bca7594f918ced2f5fThird Party Advisory
• https://github.com/splitbrain/dokuwiki/issues/1056Third Party Advisory
• https://www.dokuwiki.org/changesVendor Advisory

Published

Mar 30, 2015

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-2166Directory traversal vulnerability in the Instance Monitor in…
• CVE-2015-2167Open redirect vulnerability in the 3PI Manager in Ericsson D…
• CVE-2015-2168Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2015-2169Cross-site scripting (XSS) vulnerability in Zoho ManageEngin…
• CVE-2015-2170The upx decoder in ClamAV before 0.98.7 allows remote attack…
• CVE-2015-2171Middleware/SessionCookie.php in Slim before 2.6.0 allows rem…
• CVE-2015-2177Siemens SIMATIC S7-300 CPU devices allow remote attackers to…7.5
• CVE-2015-2178Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2015-2179The xaviershay-dm-rails gem 0.10.3.8 for Ruby allows local u…5.5
• CVE-2015-2180The DBMail driver in the Password plugin in Roundcube before…
• CVE-2015-2181Multiple buffer overflows in the DBMail driver in the Passwo…
• CVE-2015-2182Multiple cross-site scripting (XSS) vulnerabilities in ZeusC…