FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2008-0169

This CVE name corresponds to:

Entered	Topic
2008-05-31	ikiwiki -- empty password security hole

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2008-0169 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2008-0169
Phase	Assigned(20080109)

Description

Plugin/passwordauth.pm (aka the passwordauth plugin) in ikiwiki 1.34 through 2.47 allows remote attackers to bypass authentication, and login to any account for which an OpenID identity is configured and a password is not configured, by specifying an empty password during the login sequence.

References

Source	Reference
MLIST	[oss-security] 20080531 Re: CVE id request: ikiwiki
CONFIRM	http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=483770
CONFIRM	http://ikiwiki.info/news/version_2.48/index.html
CONFIRM	http://ikiwiki.info/security/#index33h2
BID	29479
VUPEN	ADV-2008-1710
SECUNIA	30468
XF	ikiwiki-openid-passwordauth-auth-bypass(42798)