Cross-Site Scripting in DokuWiki Versions Prior to 2023-04-04a
CVE-2023-34408

5.4MEDIUM

Key Information:

Vendor

Dokuwiki

Status
Dokuwiki
Vendor
CVE Published:
5 June 2023

What is CVE-2023-34408?

A security flaw in DokuWiki allows attackers to exploit cross-site scripting (XSS) via manipulated RSS titles. This vulnerability affects all DokuWiki instances prior to version 2023-04-04a, potentially exposing users to malicious payloads if they interact with crafted RSS feeds. It is essential for users to upgrade their DokuWiki installations to the latest version to mitigate this vulnerability and enhance their web security.

References

https://github.com/dokuwiki/dokuwiki/pull/3967
https://www.github.com/splitbrain/dokuwiki/commit/53df38b...
https://huntr.dev/bounties/c6119106-1a5c-464c-94dd-ee7c5d...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.