CVE-2010-1136

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2010-03-27 · updated 2026-06-16
Weakness: CWE-264

Description

The Standard Remember method in TikiWiki CMS/Groupware 3.x before 3.5 allows remote attackers to bypass access restrictions related to "persistent login," probably due to the generation of predictable cookies based on the IP address and User agent in userslib.php.

Affected products

Tiki: 3.0, 3.1, 3.2, 3.3, 3.4

References

http://info.tikiwiki.org/article86-Tiki-Announces-3-5-and-4-2-Releases
http://osvdb.org/62801
http://secunia.com/advisories/38882
http://tikiwiki.svn.sourceforge.net/viewvc/tikiwiki/branches/proposals/3.x/lib/userslib.php?r1=25196&r2=25195&pathrev=25196
http://tikiwiki.svn.sourceforge.net/viewvc/tikiwiki?view=rev&revision=25196
http://www.securityfocus.com/bid/38608
https://exchange.xforce.ibmcloud.com/vulnerabilities/56771
http://info.tikiwiki.org/article86-Tiki-Announces-3-5-and-4-2-Releases
http://osvdb.org/62801
http://secunia.com/advisories/38882
http://tikiwiki.svn.sourceforge.net/viewvc/tikiwiki/branches/proposals/3.x/lib/userslib.php?r1=25196&r2=25195&pathrev=25196
http://tikiwiki.svn.sourceforge.net/viewvc/tikiwiki?view=rev&revision=25196

Get alerted when CVE-2010-1136 or the next vulnerability affects your stack