PT-2017-12587 · Dokuwiki · Dokuwiki

Trichimtrich · Published 2017-08-06 · Updated 2018-01-11 · CVE-2017-12583

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions DokuWiki versions prior to 2017-02-19b

Description The issue concerns an XSS vulnerability in the at parameter, also known as the DATE AT variable, which is used in the "doku.php" endpoint.

Recommendations For versions prior to 2017-02-19b, consider restricting access to the at parameter in the doku.php endpoint until a fix is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-12583

MGASA-2018-0067

Affected Products

Dokuwiki

References · 12

• 🔥 https://github.com/splitbrain/dokuwiki/issues/2061 · Exploit
• https://advisories.mageia.org/MGASA-2018-0067.html · Security Note
• https://osv.dev/vulnerability/MGASA-2018-0067 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-12583 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-12583 · Security Note
• https://osv.dev/vulnerability/CVE-2017-12583 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-12583 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-12583 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-12583 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-12583 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12583 · Note
• https://bugs.mageia.org/show_bug.cgi?id=22323 · Note