XSS Vulnerability in Dokuwiki's Indexmenu Plugin
CVE-2024-42758

5.4MEDIUM

Key Information:

Vendor

Dokuwiki

Vendor
CVE Published:
16 August 2024

Badges

👾 Exploit Exists

What is CVE-2024-42758?

A Cross-site Scripting (XSS) vulnerability exists in version v2024-01-05 of the indexmenu plugin when is used and enabled in Dokuwiki (Open Source Wiki Engine). A malicious attacker can input XSS payloads for example when creating or editing existing page, to trigger the XSS on Dokuwiki, which is then stored in .txt file (due to nature of how Dokuwiki is designed), which presents stored XSS.

References

https://github.com/dokuwiki/dokuwiki
https://github.com/samuelet/indexmenu
https://github.com/samuelet/indexmenu/issues/317

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

.