FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2012-2129

This CVE name corresponds to:

Entered	Topic
2012-04-23	Dokuwiki -- cross site scripting vulnerability

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2012-2129 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2012-2129
Phase	Assigned(20120404)

Description

Cross-site scripting (XSS) vulnerability in doku.php in DokuWiki 2012-01-25 Angua allows remote attackers to inject arbitrary web script or HTML via the target parameter in an edit action.

References

Source	Reference
BUGTRAQ	20120417 DokuWiki Ver.2012/01/25 CSRF Add User Exploit
MLIST	[oss-security] 20120422 CVE Request -- DokuWiki: XSS and CSRF due improper escaping of 'target' parameter in preprocessing edit form data
MLIST	[oss-security] 20120422 Re: CVE Request -- DokuWiki: XSS and CSRF due improper escaping of 'target' parameter in preprocessing edit form data
MISC	http://ircrash.com/uploads/dokuwiki.txt
MISC	https://bugs.gentoo.org/show_bug.cgi?id=412891
MISC	https://bugzilla.redhat.com/show_bug.cgi?id=815122
CONFIRM	http://bugs.dokuwiki.org/index.php?do=details&task_id=2487
CONFIRM	https://github.com/splitbrain/dokuwiki/commit/ff71173477e54774b5571015d49d944f51cb8a26
BID	53041
SECUNIA	48848
XF	dokuwiki-doku-xss(74907)