DokuWiki before 2014-05-05d and before 2014-09-29c does not properly check permissions for the ACL plugins, which allows remote authenticated users to gain privileges and add or delete ACL rules via a request to the XMLRPC API.

Updated dokuwiki packages fix security vulnerabilities :

inc/template.php in DokuWiki before 2014-05-05a only checks for access to the root namespace, which allows remote attackers to access arbitrary images via a media file details ajax call (CVE-2014-8761).

The ajax_mediadiff function in DokuWiki before 2014-05-05a allows remote attackers to access arbitrary images via a crafted namespace in the ns parameter (CVE-2014-8762).

DokuWiki before 2014-05-05b, when using Active Directory for LDAP authentication, allows remote attackers to bypass authentication via a password starting with a null (\0) character and a valid user name, which triggers an unauthenticated bind (CVE-2014-8763).

DokuWiki 2014-05-05a and earlier, when using Active Directory for LDAP authentication, allows remote attackers to bypass authentication via a user name and password starting with a null (\0) character, which triggers an anonymous bind (CVE-2014-8764).

dokuwiki-2014-09-29a allows swf (application/x-shockwave-flash) uploads by default. This may be used for Cross-site scripting (XSS) attack which enables attackers to inject client-side script into Web pages viewed by other users. (CVE-2014-9253).

The dokuwiki-2014-09-29b hotfix source disables swf uploads by default and fixes the CVE-2014-9253 issue.

DokuWiki before 20140929c has a security issue in the ACL plugins remote API component. The plugin failed to check for superuser permissions before executing ACL addition or deletion. This means everybody with permissions to call the XMLRPC API also had permissions to set up their own ACL rules and thus circumventing any existing rules (CVE-2015-2172).

DokuWiki before 20140929d is vulnerable to a cross-site scripting (XSS) issue in the user manager. The user's details were not properly escaped in the user manager's edit form. This allows a registered user to edit her own name (using the change profile option) to include malicious JavaScript code. The code is executed when a super user tries to edit the user via the user manager.

This update fixes CVE-2015-2172

  - There's a security hole in the ACL plugins remote API     component. The plugin failes to check for superuser     permissions before executing ACL addition or deletion.
    This means everybody with permissions to call the XMLRPC     API also has permissions to set up their own ACL rules     and thus circumventing any existing rules. Update to the     2014-09-29b release which contains various fixes,     notably :

Security :

  - CVE-2014-9253 - XSS via SFW file upload

    - CVE-2012-6662 - jquery-ui XSS vulnerability

Bugfixes :

  - dokuwiki requires php-xml (RHBZ#1061477)

    - wrong SELinux file context for writable       files/directories (RHBZ#1064524)

    - drop httpd requirement (RHBZ#1164396)

Update to the 2014-09-29b release which contains various fixes, notably :

Security :

  - CVE-2014-9253 - XSS via SFW file upload

    - CVE-2012-6662 - jquery-ui XSS vulnerability

Bugfixes :

  - dokuwiki requires php-xml (RHBZ#1061477)

    - wrong SELinux file context for writable       files/directories (RHBZ#1064524)

    - drop httpd requirement (RHBZ#1164396)

Update to the 2014-09-29b release which contains various fixes, notably :

Security :

  - CVE-2014-9253 - XSS via SFW file upload

    - CVE-2012-6662 - jquery-ui XSS vulnerability

Bugfixes :

  - dokuwiki requires php-xml (RHBZ#1061477)

    - wrong SELinux file context for writable       files/directories (RHBZ#1064524)

    - drop httpd requirement (RHBZ#1164396)

Update to the 2014-09-29b release which contains various fixes, notably :

Security :

  - CVE-2014-9253 - XSS via SFW file upload

    - CVE-2012-6662 - jquery-ui XSS vulnerability

Bugfixes :

  - dokuwiki requires php-xml (RHBZ#1061477)

    - wrong SELinux file context for writable       files/directories (RHBZ#1064524)

    - drop httpd requirement (RHBZ#1164396)

This update adds dokuwiki package to EPEL7

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
82485	Mandriva Linux Security Advisory : dokuwiki (MDVSA-2015:185)	Nessus	Mandriva Local Security Checks	medium
82277	Fedora 20 : dokuwiki-0-0.24.20140929c.fc20 (2015-3211)	Nessus	Fedora Local Security Checks	medium
82276	Fedora 21 : dokuwiki-0-0.24.20140929c.fc21 (2015-3186)	Nessus	Fedora Local Security Checks	medium
82275	Fedora 22 : dokuwiki-0-0.24.20140929c.fc22 (2015-3079)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2015-2172

high

Tenable Plugins

medium

medium

medium

medium