CVE-2006-1165: XSS

Published Mar 12, 2006

Updated

Cross-site scripting (XSS) vulnerability in the mediamanager module in DokuWiki before 2006-03-05 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors relating to "handling EXIF data."

Affected Software

26 affected components

Andreas Gohr Dokuwiki=release_2004-07-04

Andreas Gohr Dokuwiki=release_2004-07-07

Andreas Gohr Dokuwiki=release_2004-07-12

Andreas Gohr Dokuwiki=release_2004-07-21

Andreas Gohr Dokuwiki=release_2004-07-25

Andreas Gohr Dokuwiki=release_2004-08-08

Andreas Gohr Dokuwiki=release_2004-08-15a

Andreas Gohr Dokuwiki=release_2004-08-22

Andreas Gohr Dokuwiki=release_2004-09-12

Andreas Gohr Dokuwiki=release_2004-09-25

Andreas Gohr Dokuwiki=release_2004-09-30

Andreas Gohr Dokuwiki=release_2004-10-19

Andreas Gohr Dokuwiki=release_2004-11-01

Andreas Gohr Dokuwiki=release_2004-11-02

Andreas Gohr Dokuwiki=release_2004-11-10

Andreas Gohr Dokuwiki=release_2005-01-14

Andreas Gohr Dokuwiki=release_2005-01-15

Andreas Gohr Dokuwiki=release_2005-01-16a

Andreas Gohr Dokuwiki=release_2005-02-06

Andreas Gohr Dokuwiki=release_2005-02-18

Andreas Gohr Dokuwiki=release_2005-05-07

Andreas Gohr Dokuwiki=release_2005-07-01

Andreas Gohr Dokuwiki=release_2005-07-13

Andreas Gohr Dokuwiki=release_2005-09-19

Andreas Gohr Dokuwiki=release_2005-09-22

Andreas Gohr Dokuwiki=release_2006-03-05

Remediation

Patch Available

http://secunia.com/advisories/19186

Event History

Mar 12, 2006

CVE Published

09:02 PM

Mar 13, 2006

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2006-1165?

CVE-2006-1165 has been classified with a severity rating that indicates it poses a moderate risk due to its ability to facilitate cross-site scripting attacks.

How do I fix CVE-2006-1165?

To fix CVE-2006-1165, update your DokuWiki installation to version 2006-03-05 or later, which addresses the XSS vulnerability.

What type of vulnerability is CVE-2006-1165?

CVE-2006-1165 is a cross-site scripting (XSS) vulnerability that allows attackers to inject arbitrary web scripts or HTML.

Which versions of DokuWiki are affected by CVE-2006-1165?

CVE-2006-1165 affects all DokuWiki versions prior to 2006-03-05.

What can attackers do with CVE-2006-1165?

Attackers exploiting CVE-2006-1165 can inject malicious scripts into web pages viewed by users, potentially compromising their session or stealing sensitive information.