REDHAT-BUG-717146: XSS
First published: Tue Jun 28 2011(Updated: )
It was found that DokuWiki's RSS embedding mechanism did not properly escape user-provided links. An attacker could use this flaw to conduct cross-site scripting (XSS) attacks, potentially leading to arbitrary JavaScript code execution. References: [1] <a href="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=631818">http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=631818</a> [2] <a href="http://www.certa.ssi.gouv.fr/site/CERTA-2011-AVI-366/CERTA-2011-AVI-366.html">http://www.certa.ssi.gouv.fr/site/CERTA-2011-AVI-366/CERTA-2011-AVI-366.html</a> [3] <a href="http://www.freelists.org/post/dokuwiki/Hotfix-Release-20110525a-Rincewind">http://www.freelists.org/post/dokuwiki/Hotfix-Release-20110525a-Rincewind</a> Solution: This issue has been addressed in upstream "2011-05-25 Rincewind" release: [4] <a href="http://www.dokuwiki.org/changes">http://www.dokuwiki.org/changes</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| DokuWiki | <2011-05-25 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=631818
- http://www.certa.ssi.gouv.fr/site/CERTA-2011-AVI-366/CERTA-2011-AVI-366.html
- http://www.freelists.org/post/dokuwiki/Hotfix-Release-20110525a-Rincewind
- http://www.dokuwiki.org/changes
- http://www.openwall.com/lists/oss-security/2011/06/28/5
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=717148
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=717149
- https://access.redhat.com/security/cve/CVE-2011-2510
- http://www.openwall.com/lists/oss-security/2011/06/29/13
- https://bugzilla.redhat.com/show_bug.cgi?id=717146
Frequently Asked Questions
What is the severity of REDHAT-BUG-717146?
REDHAT-BUG-717146 is classified as a moderate severity vulnerability due to its potential for cross-site scripting (XSS) attacks.
How do I fix REDHAT-BUG-717146?
To fix REDHAT-BUG-717146, update DokuWiki to a version newer than 2011-05-25 where this vulnerability has been addressed.
What type of vulnerability is REDHAT-BUG-717146?
REDHAT-BUG-717146 is a cross-site scripting (XSS) vulnerability affecting DokuWiki's RSS embedding mechanism.
What can attackers achieve through REDHAT-BUG-717146?
Attackers exploiting REDHAT-BUG-717146 can execute arbitrary JavaScript code in the context of the user's browser.
Which versions of DokuWiki are affected by REDHAT-BUG-717146?
DokuWiki versions up to 2011-05-25 are affected by REDHAT-BUG-717146.
- agent/references
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2011-2510
- agent/weakness
- agent/severity
- agent/event
- agent/description
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/dokuwiki
- canonical/dokuwiki