Cross-site scripting (XSS) vulnerability in the tpl_mediaFileList function in inc/template.php in DokuWiki before 2012-01-25b allows remote attackers to inject arbitrary web script or HTML via the ns parameter in a medialist action to lib/exe/ajax.php.

The remote host is affected by the vulnerability described in GLSA-201301-07 (DokuWiki: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in DokuWiki. Please review       the CVE identifiers referenced below for details.
  Impact :

    The vulnerabilities might allow an attacker to disclose local files, to       inject arbitrary web script, or to gain elevated privileges in the       DokuWiki application.
  Workaround :

    There is no known workaround at this time.

upgrade to latest upstream Update to latest upstream

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

upgrade to latest upstream

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Secunia Research reports :

Secunia Research has discovered a vulnerability in DokuWiki, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed to the 'ns' POST parameter in lib/exe/ajax.php (when 'call' is set to 'medialist' and 'do' is set to 'media') is not properly sanitised within the 'tpl_mediaFileList()' function in inc/template.php before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

ID	Name	Product	Family	Severity
63441	GLSA-201301-07 : DokuWiki: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
62752	Fedora 17 : dokuwiki-0-0.14.20121013.fc17 (2012-16614)	Nessus	Fedora Local Security Checks	medium
62751	Fedora 16 : dokuwiki-0-0.14.20121013.fc16 (2012-16605)	Nessus	Fedora Local Security Checks	medium
62699	Fedora 18 : dokuwiki-0-0.14.20121013.fc18 (2012-16550)	Nessus	Fedora Local Security Checks	medium
60055	FreeBSD : Dokuwiki -- XSS vulnerability (2fe4b57f-d110-11e1-ac76-10bf48230856)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2012-0283

medium

Tenable Plugins

high

medium

medium

medium

medium