CSV Injection in DokuWiki Affects User Data Export
CVE-2018-15474

9.6CRITICAL

Key Information:

Vendor

Dokuwiki

Status
Dokuwiki
Vendor
CVE Published:
7 September 2018

What is CVE-2018-15474?

CSV Injection, also known as Excel Macro Injection or Formula Injection, is a vulnerability found in DokuWiki versions up to 2018-04-22a. This flaw occurs in the user manager module where improperly handled values in CSV exports can lead to sensitive data exfiltration and the execution of arbitrary code by remote attackers. Despite the vendor's assertion that this isn't a security issue, the implications of such a vulnerability pose significant risks for user data integrity and security.

References

https://github.com/splitbrain/dokuwiki/issues/2450
x_refsource_CONFIRM
https://www.sec-consult.com/en/blog/advisories/dokuwiki-c...
x_refsource_MISC
https://seclists.org/fulldisclosure/2018/Sep/4
mailing-listx_refsource_FULLDISC

CVSS V3.1

Score:
9.6
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.