CVE-2019-9187
Publication date 5 June 2019
Last updated 26 August 2025
Ubuntu priority
Description
ikiwiki before 3.20170111.1 and 3.2018x and 3.2019x before 3.20190228 allows SSRF via the aggregate plugin. The impact also includes reading local files via file: URIs.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| ikiwiki | 25.10 questing |
Not affected
|
| 25.04 plucky |
Not affected
|
|
| 24.04 LTS noble |
Not affected
|
|
| 22.04 LTS jammy |
Not affected
|
|
| 20.04 LTS focal |
Not affected
|
|
| 18.04 LTS bionic |
Needs evaluation
|
|
| 16.04 LTS xenial |
Needs evaluation
|
|
| 14.04 LTS trusty | Not in release |
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
7.5 · High
|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | None |
| Availability impact | None |
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
References
Other references
- https://ikiwiki.info/security/#cve-2019-9187
- https://www.openwall.com/lists/oss-security/2019/02/28/1
- http://source.ikiwiki.branchable.com/?p=source.git;a=commitdiff;h=e7b0d4a
- http://source.ikiwiki.branchable.com/?p=source.git;a=commitdiff;h=67543ce
- http://source.ikiwiki.branchable.com/?p=source.git;a=commitdiff;h=d283e4c
- http://source.ikiwiki.branchable.com/?p=source.git;a=commitdiff;h=9a275b2
- https://www.cve.org/CVERecord?id=CVE-2019-9187