PT-2012-3824 · Dokuwiki · Dokuwiki

Khashayar Fereidani · Published 2012-08-27 · Updated 2024-08-06 · CVE-2012-2128

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions DokuWiki version 2012-01-25 Angua

Description A cross-site request forgery (CSRF) issue in doku.php allows remote attackers to hijack the authentication of administrators for requests that add arbitrary users. The vendor disputes this issue, stating it is resultant from another vulnerability, where the exploit code uses an XSS hole to extract a valid CSRF token.

Recommendations For DokuWiki version 2012-01-25 Angua, at the moment, there is no information about a newer version that contains a fix for this issue.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2012-2128

Affected Products

Dokuwiki

References · 19

• https://ubuntu.com/security/CVE-2012-2128 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-2128 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2012-2128 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-2128 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2012-2128 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-2128 · Security Note
• http://secunia.com/advisories/48848 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-2128 · Vendor Advisory
• http://bugs.dokuwiki.org/index.php?do=details&task_id=2488 · Note
• http://seclists.org/bugtraq/2012/Apr/121 · Note
• http://openwall.com/lists/oss-security/2012/04/22/4 · Note
• https://t.me/cvenotify/89504 · Telegram Post
• http://openwall.com/lists/oss-security/2012/04/23/1 · Note
• http://openwall.com/lists/oss-security/2012/04/22 · Note
• http://ircrash.com/uploads/dokuwiki.txt · Note