Cross-Site Scripting in DokuWiki Media Manager
CVE-2014-9253

Currently unrated

Key Information:

Vendor

Dokuwiki

Status
Dokuwiki
Vendor
CVE Published:
17 December 2014

What is CVE-2014-9253?

The Media Manager in DokuWiki prior to version 2014-09-29b has a default file type whitelist vulnerability in its configuration file (conf/mime.conf). This flaw permits remote attackers to execute arbitrary web scripts or HTML by uploading a malicious SWF file. Subsequently, attackers can access the uploaded file through the media parameter in the fetch.php script, potentially leading to unauthorized actions and data breaches.

References

http://security.szurek.pl/dokuwiki-20140929a-xss.html
x_refsource_MISC
http://www.securitytracker.com/id/1031369
vdb-entryx_refsource_SECTRACK
https://exchange.xforce.ibmcloud.com/vulnerabilities/99291
vdb-entryx_refsource_XF

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.