CVE-2014-9253

EUVD-2014-9078
The default file type whitelist configuration in conf/mime.conf in the Media Manager in DokuWiki before 2014-09-29b allows remote attackers to execute arbitrary web script or HTML by uploading an SWF file, then accessing it via the media parameter to lib/exe/fetch.php.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 68%
Affected Products (NVD)
VendorProductVersion
dokuwikidokuwiki
𝑥
≤ 2014-05-05c
mageiamageia
4.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
dokuwiki
bookworm
0.0.20220731.a-2
fixed
bullseye
0.0.20180422.a-2.1
fixed
jessie
no-dsa
sid
0.0.20220731.a-3
fixed
squeeze
no-dsa
trixie
0.0.20220731.a-3
fixed
wheezy
no-dsa
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
dokuwiki
artful
not-affected
bionic
not-affected
cosmic
not-affected
disco
not-affected
lucid
ignored
precise
ignored
trusty
dne
utopic
ignored
vivid
ignored
wily
ignored
xenial
not-affected
yakkety
not-affected
zesty
not-affected
Common Weakness Enumeration
References
http://advisories.mageia.org/MGASA-2014-0540.html
http://seclists.org/oss-sec/2014/q4/1050
http://security.szurek.pl/dokuwiki-20140929a-xss.html
http://www.securityfocus.com/bid/71671
http://www.securitytracker.com/id/1031369
https://exchange.xforce.ibmcloud.com/vulnerabilities/99291
https://github.com/splitbrain/dokuwiki/commit/778ddf6f2cd9ed38b9db2d73e823b8c21243a960
https://www.dokuwiki.org/changes
http://advisories.mageia.org/MGASA-2014-0540.html
http://seclists.org/oss-sec/2014/q4/1050
http://security.szurek.pl/dokuwiki-20140929a-xss.html
http://www.securityfocus.com/bid/71671
http://www.securitytracker.com/id/1031369
https://exchange.xforce.ibmcloud.com/vulnerabilities/99291
https://github.com/splitbrain/dokuwiki/commit/778ddf6f2cd9ed38b9db2d73e823b8c21243a960
https://www.dokuwiki.org/changes