CVE-2016-7965

NONE EPSS 64.7%
Published Oct 31, 20169y ago · Modified Jun 17, 20262w ago
Find Similar
Published Oct 31, 2016 9y ago
Last Modified Jun 17, 2026 2w ago

Description

DokuWiki 2016-06-26a and older uses $_SERVER[HTTP_HOST] instead of the baseurl setting as part of the password-reset URL. This can lead to phishing attacks. (A remote unauthenticated attacker can change the URL's hostname via the HTTP Host header.) The vulnerability can be triggered only if the Host header is not part of the web server routing process (e.g., if several domains are served by the same web server).

Threat Intelligence

EPSS Exploit Probability
64.7% percentile
Exploit & Patch Status
Public Exploit Known
No Patch Available

Weaknesses 1

CWE-20 Improper Input Validation Validation

Affected Products 1

VendorProductVersionRange
dokuwikidokuwiki* ≤2016-06-26a

References 2

  • securityfocus.com http://www.securityfocus.com/bid/94237
  • github.com https://github.com/splitbrain/dokuwiki/issues/1709
    ExploitVendor Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.