Published: 17/12/2014 Updated: 08/09/2017

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

The default file type whitelist configuration in conf/mime.conf in the Media Manager in DokuWiki prior to 2014-09-29b allows remote malicious users to execute arbitrary web script or HTML by uploading an SWF file, then accessing it via the media parameter to lib/exe/fetch.php.

Vulnerable Product	Search on Vulmon	Subscribe to Product
dokuwiki dokuwiki
mageia mageia 4.0

Debian Bug report logs - #779547 dokuwiki: CVE-2015-2172: DokuWiki privilege escalation in RPC API Package: src:dokuwiki; Maintainer for src:dokuwiki is Tanguy Ortolo <tanguy+debian@ortoloeu>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Mon, 2 Mar 2015 05:51:01 UTC Severity: grave Tags: fixed-upstre ...

Debian Bug report logs - #780817 dokuwiki: Insufficient escaping in user manager allows XSS attack Package: dokuwiki; Maintainer for dokuwiki is Tanguy Ortolo <tanguy+debian@ortoloeu>; Source for dokuwiki is src:dokuwiki (PTS, buildd, popcon) Reported by: Rodrigo Campos <rodrigo@sdfgcomar> Date: Thu, 19 Mar 2015 2 ...

Debian Bug report logs - #773429 dokuwiki: CVE-2014-9253 Package: dokuwiki; Maintainer for dokuwiki is Tanguy Ortolo <tanguy+debian@ortoloeu>; Source for dokuwiki is src:dokuwiki (PTS, buildd, popcon) Reported by: Moritz Muehlenhoff <jmm@inutilorg> Date: Thu, 18 Dec 2014 10:09:02 UTC Severity: important Tags: secu ...

CWE-79 https://www.dokuwiki.org/changes http://security.szurek.pl/dokuwiki-20140929a-xss.html http://www.securitytracker.com/id/1031369 https://github.com/splitbrain/dokuwiki/commit/778ddf6f2cd9ed38b9db2d73e823b8c21243a960 http://seclists.org/oss-sec/2014/q4/1050 http://www.securityfocus.com/bid/71671 http://advisories.mageia.org/MGASA-2014-0540.html https://exchange.xforce.ibmcloud.com/vulnerabilities/99291 https://nvd.nist.gov https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=779547

CVE-2014-9253

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect