Vulnerability Description
The default file type whitelist configuration in conf/mime.conf in the Media Manager in DokuWiki before 2014-09-29b allows remote attackers to execute arbitrary web script or HTML by uploading an SWF file, then accessing it via the media parameter to lib/exe/fetch.php.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Dokuwiki | Dokuwiki | <= 2014-05-05c |
| Mageia | Mageia | 4.0 |
Related Weaknesses (CWE)
References
- http://advisories.mageia.org/MGASA-2014-0540.htmlThird Party Advisory
- http://seclists.org/oss-sec/2014/q4/1050Third Party AdvisoryVDB Entry
- http://security.szurek.pl/dokuwiki-20140929a-xss.htmlThird Party Advisory
- http://www.securityfocus.com/bid/71671Not Applicable
- http://www.securitytracker.com/id/1031369Third Party AdvisoryVDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/99291
- https://github.com/splitbrain/dokuwiki/commit/778ddf6f2cd9ed38b9db2d73e823b8c212Issue TrackingPatch
- https://www.dokuwiki.org/changesRelease Notes
- http://advisories.mageia.org/MGASA-2014-0540.htmlThird Party Advisory
- http://seclists.org/oss-sec/2014/q4/1050Third Party AdvisoryVDB Entry
- http://security.szurek.pl/dokuwiki-20140929a-xss.htmlThird Party Advisory
- http://www.securityfocus.com/bid/71671Not Applicable
- http://www.securitytracker.com/id/1031369Third Party AdvisoryVDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/99291
- https://github.com/splitbrain/dokuwiki/commit/778ddf6f2cd9ed38b9db2d73e823b8c212Issue TrackingPatch
FAQ
What is CVE-2014-9253?
CVE-2014-9253 is a vulnerability with a CVSS score of 4.3 (MEDIUM). The default file type whitelist configuration in conf/mime.conf in the Media Manager in DokuWiki before 2014-09-29b allows remote attackers to execute arbitrary web script or HTML by uploading an SWF ...
How severe is CVE-2014-9253?
CVE-2014-9253 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2014-9253?
Check the references section above for vendor advisories and patch information. Affected products include: Dokuwiki Dokuwiki, Mageia Mageia.