1. Home
  2. CVE Database
  3. CVE-2016-7965
MEDIUM · 6.5

CVE-2016-7965

DokuWiki 2016-06-26a and older uses $_SERVER[HTTP_HOST] instead of the baseurl setting as part of the password-reset URL. This can lead to phishing attacks. (A remote unauthenticated attacker can chan...

Vulnerability Description

DokuWiki 2016-06-26a and older uses $_SERVER[HTTP_HOST] instead of the baseurl setting as part of the password-reset URL. This can lead to phishing attacks. (A remote unauthenticated attacker can change the URL's hostname via the HTTP Host header.) The vulnerability can be triggered only if the Host header is not part of the web server routing process (e.g., if several domains are served by the same web server).

CVSS Score

6.5

MEDIUM

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
NONE
Integrity
HIGH
Availability
NONE

Affected Products

VendorProductVersions
DokuwikiDokuwiki<= 2016-06-26a

Related Weaknesses (CWE)

CWE-20

References

FAQ

What is CVE-2016-7965?

CVE-2016-7965 is a vulnerability with a CVSS score of 6.5 (MEDIUM). DokuWiki 2016-06-26a and older uses $_SERVER[HTTP_HOST] instead of the baseurl setting as part of the password-reset URL. This can lead to phishing attacks. (A remote unauthenticated attacker can chan...

How severe is CVE-2016-7965?

CVE-2016-7965 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2016-7965?

Check the references section above for vendor advisories and patch information. Affected products include: Dokuwiki Dokuwiki.