CVE

Id
76554  
CVE No.
CVE-2014-9253  
Status
Candidate  
Description
The default file type whitelist configuration in conf/mime.conf in the Media Manager in DokuWiki before 2014-09-29b allows remote attackers to execute arbitrary web script or HTML by uploading an SWF file, then accessing it via the media parameter to lib/exe/fetch.php.  
Phase
Assigned (20141204)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
704138 76554 CVE-2014-9253 MLIST:[oss-security] 20141215 Re: CVE request: XSS flaw fixed in dokuwiki 2014-09-29b  View
704139 76554 CVE-2014-9253 URL:http://seclists.org/oss-sec/2014/q4/1050  View
704140 76554 CVE-2014-9253 MISC:http://security.szurek.pl/dokuwiki-20140929a-xss.html  View
704141 76554 CVE-2014-9253 CONFIRM:https://github.com/splitbrain/dokuwiki/commit/778ddf6f2cd9ed38b9db2d73e823b8c21243a960  View
704142 76554 CVE-2014-9253 CONFIRM:https://www.dokuwiki.org/changes  View
704143 76554 CVE-2014-9253 CONFIRM:http://advisories.mageia.org/MGASA-2014-0540.html  View
704144 76554 CVE-2014-9253 BID:71671  View
704145 76554 CVE-2014-9253 URL:http://www.securityfocus.com/bid/71671  View
704146 76554 CVE-2014-9253 SECTRACK:1031369  View
704147 76554 CVE-2014-9253 URL:http://www.securitytracker.com/id/1031369  View
704148 76554 CVE-2014-9253 XF:dokuwiki-cve20149253-xss(99291)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
19115 JVNDB-2014-007990 Codoforum の sanitize 関数における任意のファイルを読まれる脆弱性 Codoforum の sanitize 関数は、ディレクトリトラバーサルシーケンスのフィルタリングを適切に実装していないため、任意のファイルを読まれる脆弱性が存在します。 CVE-2014-9261 76554 5 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-007990.html  View