Secunia

A security issue has been reported in ikiwiki, which can be exploited by malicious people to bypass certain security restrictions.

The security issue is caused due to an error in the "openid" and "passwordauth" plugins when processing login requests with empty passwords. This can be exploited to gain access to user accounts that have an associated "openid" account without a configured password.

Successful exploitation requires that the "openid" and "passwordauth" plugins are enabled.

The security issue is reported in versions 1.34 and later, prior to 2.48.

Solution
Update to version 2.48.

Provided and/or discovered by
Joey Hess, Debian

Original Advisory
ikiwiki:
http://ikiwiki.info/security/#index33h2

Debian:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=483770

Deep Links
Links available in Customer Area