LDAP Authentication Vulnerability in DokuWiki by DokuWiki
CVE-2014-8763

Currently unrated

Key Information:

Vendor

Dokuwiki

Status
Dokuwiki
Vendor
CVE Published:
22 October 2014

What is CVE-2014-8763?

A vulnerability exists in DokuWiki's LDAP authentication mechanism prior to version 2014-05-05b, which allows remote attackers to exploit a flaw in how the application processes usernames. By using a password that begins with a null character, attackers can bypass authentication entirely, triggering an unauthenticated bind to the LDAP server. This serious issue emphasizes the need for organizations using DokuWiki with LDAP authentication to update their installations and implement stricter security measures.

References

http://www.freelists.org/post/dokuwiki/Fwd-Dokuwiki-maybe...
mailing-listx_refsource_MLIST
http://secunia.com/advisories/61983
third-party-advisoryx_refsource_SECUNIA
http://advisories.mageia.org/MGASA-2014-0438.html
x_refsource_CONFIRM

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.