CVE-2024-42758: XSS

Published Aug 16, 2024

Updated

A Cross-site Scripting (XSS) vulnerability exists in version v2024-01-05 of the indexmenu plugin when is used and enabled in Dokuwiki (Open Source Wiki Engine). A malicious attacker can input XSS payloads for example when creating or editing existing page, to trigger the XSS on Dokuwiki, which is then stored in .txt file (due to nature of how Dokuwiki is designed), which presents stored XSS.

Affected Software

2 affected components

DokuWiki indexmenu plugin

DokuWiki DokuWiki

Event History

Aug 16, 2024

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·06:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-42758?

CVE-2024-42758 is categorized as a Cross-site Scripting (XSS) vulnerability, which can be severe depending on the context of its exploit.

How do I fix CVE-2024-42758?

To fix CVE-2024-42758, update the indexmenu plugin to the latest version that addresses this vulnerability.

Who is affected by CVE-2024-42758?

CVE-2024-42758 affects users of the Dokuwiki indexmenu plugin when it is used and enabled in Dokuwiki.

What kind of attack can be executed due to CVE-2024-42758?

An attacker can execute Cross-site Scripting (XSS) payloads to manipulate users' interactions within Dokuwiki.

When was CVE-2024-42758 disclosed?

CVE-2024-42758 was disclosed on January 5, 2024.