ChatWiki cross-tenant data modification and disclosure flaws
Anyone can view and change other users' files in the ChatWiki chatbot tool.
Summary
Before ChatWiki 2.10.0, a logged-in user can change other tenants' fast commands and form fields, and some documents can be read without logging in. Anyone who runs ChatWiki themselves is affected.
What to do
Update to ChatWiki 2.10.0.
Products and platforms
CVE IDs
Sources
- Advisory: github.com (opens in a new tab)
- Write-up: github.com (opens in a new tab) · hackmd.io (opens in a new tab) · vulncheck.com (opens in a new tab) · github.com (opens in a new tab) · hackmd.io (opens in a new tab) · vulncheck.com (opens in a new tab) · github.com (opens in a new tab) · vulncheck.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab)
Times
First published
First seen