WikkaWiki 'backlinks' Handler Information Disclosure Vulnerability

Bugtraq ID:	33793
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 14 2009 12:00AM
Updated:	Feb 18 2009 10:57PM
Credit:	grbg
Vulnerable:	WikkaWiki WikkaWiki 1.1.6.5 WikkaWiki WikkaWiki 1.1.6.3
Not Vulnerable:	WikkaWiki WikkaWiki 1.1.6.6

WikkaWiki 'backlinks' Handler Information Disclosure Vulnerability

WikkaWiki is prone to an information-disclosure vulnerability because it fails to restrict access to certain webpages.

An attacker can exploit this vulnerability to obtain information about restricted pages (such as page titles).

The issue affects versions prior to WikkaWiki 1.1.6.6.

WikkaWiki 'backlinks' Handler Information Disclosure Vulnerability

Attackers can exploit this issue via a browser.

WikkaWiki 'backlinks' Handler Information Disclosure Vulnerability

Solution:
The vendor has released updates. Please see the references for details.


WikkaWiki WikkaWiki 1.1.6.5

• WikkaWiki Wikka-1.1.6.6.tar.gz
  http://wikkawiki.org/downloads/Wikka-1.1.6.6.tar.gz

WikkaWiki WikkaWiki 1.1.6.3

• WikkaWiki Wikka-1.1.6.6.tar.gz
  http://wikkawiki.org/downloads/Wikka-1.1.6.6.tar.gz

WikkaWiki 'backlinks' Handler Information Disclosure Vulnerability

References:

• Backlinks handler displays page tags for non-readable pages (WikkaWiki)
  
• Wikka 1.1.6.6 Release Notes (WikkaWiki)
  
• WikkaWiki Homepage (WikkaWiki)