PT-2012-3824 · Dokuwiki · Dokuwiki

Khashayar Fereidani · Publicado 2012-08-27 · Atualizado 2024-08-06 · CVE-2012-2128

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions DokuWiki version 2012-01-25 Angua

Description A cross-site request forgery (CSRF) issue in doku.php allows remote attackers to hijack the authentication of administrators for requests that add arbitrary users. The vendor disputes this issue, stating it is resultant from another vulnerability, where the exploit code uses an XSS hole to extract a valid CSRF token.

Recommendations For DokuWiki version 2012-01-25 Angua, at the moment, there is no information about a newer version that contains a fix for this issue.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2012-2128

Produtos afetados

Dokuwiki

Referências · 19

• https://ubuntu.com/security/CVE-2012-2128 · Aviso do Fabricante
• http://bugs.dokuwiki.org/index.php?do=details&task_id=2488 · Nota
• https://security-tracker.debian.org/tracker/CVE-2012-2128 · Aviso do Fabricante
• http://seclists.org/bugtraq/2012/Apr/121 · Nota
• http://openwall.com/lists/oss-security/2012/04/22/4 · Nota
• https://t.me/cvenotify/89504 · Publicação no Telegram
• http://openwall.com/lists/oss-security/2012/04/23/1 · Nota
• http://openwall.com/lists/oss-security/2012/04/22 · Nota
• https://cve.org/CVERecord?id=CVE-2012-2128 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-2128 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2012-2128 · Aviso do Fabricante
• http://ircrash.com/uploads/dokuwiki.txt · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-2128 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2128 · Nota
• http://secunia.com/advisories/48848 · Aviso do Fabricante