PT-2016-7448 · Dokuwiki+1 · Dokuwiki+1

Ambulong + 1 · Published 2016-10-31 · Updated 2016-11-28 · CVE-2016-7965

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions DokuWiki versions 2016-06-26a and older

Description The issue allows a remote unauthenticated attacker to change the hostname in the password-reset URL via the HTTP Host header, potentially leading to phishing attacks. This can be triggered if the Host header is not part of the web server routing process, such as when multiple domains are served by the same web server.

Recommendations For DokuWiki versions 2016-06-26a and older, consider updating to a version that uses the baseurl setting instead of $ SERVER['HTTP HOST'] for the password-reset URL. As a temporary workaround, ensure that the Host header is part of the web server routing process to prevent exploitation. Restrict access to the password-reset functionality until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2016-7965

Affected Products

Debian

Dokuwiki

References · 13

• 🔥 https://github.com/splitbrain/dokuwiki/issues/1709 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7965 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2016-7965 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-7965 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-7965 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-7965 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-7965 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-7965 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-7965 · Security Note
• https://security-tracker.debian.org/tracker/source-package/dokuwiki · Vendor Advisory
• https://packages.debian.org/src:dokuwiki · Note
• http://securityfocus.com/bid/94237 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7965 · Note