Cross-site scripting (XSS) vulnerability in the RSS embedding feature in DokuWiki before 2011-05-25a Rincewind allows remote attackers to inject arbitrary web script or HTML via a link.

The remote host is affected by the vulnerability described in GLSA-201301-07 (DokuWiki: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in DokuWiki. Please review       the CVE identifiers referenced below for details.
  Impact :

    The vulnerabilities might allow an attacker to disclose local files, to       inject arbitrary web script, or to gain elevated privileges in the       DokuWiki application.
  Workaround :

    There is no known workaround at this time.

The DokuWiki update included in Debian Lenny 5.0.9 to address a cross site scripting issue (CVE-2011-2510 ) had a regression rendering links to external websites broken. This update corrects that regression.

Fix: XSS in DokuWiki's RSS embedding mechanism

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
63441	GLSA-201301-07 : DokuWiki: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
56415	Debian DSA-2320-1 : dokuwiki - regression fix	Nessus	Debian Local Security Checks	medium
55526	Fedora 15 : dokuwiki-0-0.9.20110525.a.fc15 (2011-8831)	Nessus	Fedora Local Security Checks	medium
55525	Fedora 14 : dokuwiki-0-0.8.20110525.a.fc14 (2011-8816)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2011-2510

medium

Tenable Plugins

high

medium

medium

medium