Cross-site request forgery (CSRF) vulnerability in doku.php in DokuWiki 2012-01-25 Angua allows remote attackers to hijack the authentication of administrators for requests that add arbitrary users. NOTE: this issue has been disputed by the vendor, who states that it is resultant from CVE-2012-2129: "the exploit code simply uses the XSS hole to extract a valid CSRF token."

Fix XSS Flaw

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix XSS flaw

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Andy Webber reports :

Add User appears to be vulnerable to Cross Site Request Forgery (CSRF).

ID	Name	Product	Family	Severity
59450	Fedora 15 : dokuwiki-0-0.10.20110525.a.fc15 (2012-6630)	Nessus	Fedora Local Security Checks	medium
59258	Fedora 16 : dokuwiki-0-0.10.20110525.a.fc16 (2012-6628)	Nessus	Fedora Local Security Checks	medium
58970	Fedora 17 : dokuwiki-0-0.11.20110525.a.fc17 (2012-6588)	Nessus	Fedora Local Security Checks	medium
58838	FreeBSD : Dokuwiki -- XSS vulnerability (a04247f1-8d9c-11e1-93c7-00215c6a37bb)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2012-2128

high

Tenable Plugins

medium

medium

medium

medium