SB2012080401 - Fedora EPEL 5 update for dokuwiki
Published: August 4, 2012 Updated: April 24, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Information disclosure (CVE-ID: CVE-2011-3727)
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
DokuWiki 2009-12-25c allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by lib/tpl/index.php and certain other files.
2) Cross-site scripting (CVE-ID: CVE-2012-2129)
Vulnerability allows a remote attacker to perform XSS attacks.
The vulnerability is caused by an input validation error in doku.php in DokuWiki 2012-01-25 Angua when processing target parameter in an edit action. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
3) Information disclosure (CVE-ID: CVE-2012-3354)
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
doku.php in DokuWiki, as used in Fedora 16, 17, and 18, when certain PHP error levels are set, allows remote attackers to obtain sensitive information via the prefix parameter, which reveals the installation path in an error message.
4) Cross-site scripting (CVE-ID: CVE-2012-0283)
Vulnerability allows a remote attacker to perform Cross-site scripting attacks.
An input validation error exists in the tpl_mediaFileList function in inc/template.php in DokuWiki before 2012-01-25b when processing ns parameter in a medialist action to lib/exe/ajax.php. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
Remediation
Install update from vendor's website.