Description
Cross-site scripting (XSS) vulnerability in the RSS embedding feature in DokuWiki before 2011-05-25a Rincewind allows remote attackers to inject arbitrary web script or HTML via a link.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | dokuwiki | 0.0.20110525a-1 | — |
| Debian 13 | dokuwiki | 0.0.20110525a-1 | — |
| Debian 12 | dokuwiki | 0.0.20110525a-1 | — |
References
- 48364 vdb-entry
- FEDORA-2011-8816 vendor-advisory
- dokuwiki-rss-xss(68122) vdb-entry
- 45009 third-party-advisory
- GLSA-201301-07 vendor-advisory
- http://www.dokuwiki.org/changes
- [oss-security] 20110629 Re: CVE Request -- DokuWiki -- XSS in DokuWiki's RSS embedding mechanism mailing-list
- FEDORA-2011-8831 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=717146
- http://www.certa.ssi.gouv.fr/site/CERTA-2011-AVI-366/CERTA-2011-AVI-366.html
- DSA-2320 vendor-advisory
- [dokuwiki] 20110614 Hotfix Release "2011-05-25a Rincewind" mailing-list
- [oss-security] 20110628 CVE Request -- DokuWiki -- XSS in DokuWiki's RSS embedding mechanism mailing-list
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=631818
- 45190 third-party-advisory