FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2012-2128

This CVE name corresponds to:

Entered	Topic
2012-04-23	Dokuwiki -- cross site scripting vulnerability

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2012-2128 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2012-2128
Phase	Assigned(20120404)

Description

** DISPUTED ** Cross-site request forgery (CSRF) vulnerability in doku.php in DokuWiki 2012-01-25 Angua allows remote attackers to hijack the authentication of administrators for requests that add arbitrary users. NOTE: this issue has been disputed by the vendor, who states that it is resultant from CVE-2012-2129: "the exploit code simply uses the XSS hole to extract a valid CSRF token."

References

Source	Reference
BUGTRAQ	20120417 DokuWiki Ver.2012/01/25 CSRF Add User Exploit
MLIST	[oss-security] 20120422 CVE Request -- DokuWiki: XSS and CSRF due improper escaping of 'target' parameter in preprocessing edit form data
MLIST	[oss-security] 20120422 Re: CVE Request -- DokuWiki: XSS and CSRF due improper escaping of 'target' parameter in preprocessing edit form data
MISC	http://bugs.dokuwiki.org/index.php?do=details&task_id=2488
MISC	http://ircrash.com/uploads/dokuwiki.txt
MISC	https://bugzilla.redhat.com/show_bug.cgi?id=815122
BID	53041
SECUNIA	48848
XF	dokuwiki-doku-xss(74907)