The call parameter of /lib/exe/ajax.php in DokuWiki through 2017-02-19e does not properly encode user input, which leads to a reflected file download vulnerability, and allows remote attackers to run arbitrary programs.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The call parameter of /lib/exe/ajax.php in DokuWiki through 2017-02-19e does not properly encode user     input, which leads to a reflected file download vulnerability, and allows remote attackers to run     arbitrary programs. (CVE-2017-18123)

Note that Nessus relies on the presence of the package as reported by the vendor.

The call parameter of /lib/exe/ajax.php in DokuWiki through 2017-02-19e does not properly encode user input, which leads to a reflected file download vulnerability, and allows remote attackers to run arbitrary programs.

For Debian 8 'Jessie', these problems have been fixed in version 0.0.20140505.a+dfsg-4+deb8u1.

We recommend that you upgrade your dokuwiki packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that an XHR/AJAX call did not properly encode user input in the 'dokuwiki' wiki platform. This resulted in a reflected file download vulnerability.

For Debian 7 'Wheezy', this issue has been fixed in dokuwiki version 0.0.20120125b-2+deb7u2.

We recommend that you upgrade your dokuwiki packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
253981	Linux Distros Unpatched Vulnerability : CVE-2017-18123	Nessus	Misc.	high
110926	Debian DLA-1413-1 : dokuwiki security update	Nessus	Debian Local Security Checks	high
106592	Debian DLA-1269-1 : dokuwiki security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2017-18123

high

Tenable Plugins

high

high

high