CVE-2012-3354: Infoleak
A full path disclosure flaw was found in the way DokuWiki, a standards compliant, simple to use Wiki, performed sanitization of HTTP POST 'prefix' input value prior passing it to underlying PHP substr() routine, when the PHP error level has been enabled on the particular server. A remote attacker could use this flaw to obtain full path location of particular requested DokuWiki page by issuing a specially-crafted HTTP POST request.
References: [1] http://www.openwall.com/lists/oss-security/2012/06/24/2 [2] http://www.openwall.com/lists/oss-security/2012/06/25/2
Other sources
doku.php in DokuWiki, as used in Fedora 16, 17, and 18, when certain PHP error levels are set, allows remote attackers to obtain sensitive information via the prefix parameter, which reveals the installation path in an error message.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-3354?
CVE-2012-3354 has a medium severity rating due to its potential for information disclosure.
How do I fix CVE-2012-3354?
To fix CVE-2012-3354, update DokuWiki to the latest version where the flaw has been patched.
Who is affected by CVE-2012-3354?
CVE-2012-3354 impacts users of DokuWiki on specific versions of Fedora including 16, 17, and 18.
What type of vulnerability is CVE-2012-3354?
CVE-2012-3354 is a full path disclosure vulnerability that can expose sensitive path information.
Can CVE-2012-3354 be exploited remotely?
Yes, CVE-2012-3354 can be exploited remotely by an attacker when PHP error reporting is enabled.