NVD

Id
21980  
Name
CVE-2016-7965  
Description
DokuWiki 2016-06-26a and older uses $_SERVER[HTTP_HOST] instead of the baseurl setting as part of the password-reset URL. This can lead to phishing attacks. (A remote unauthenticated attacker can change the URL"s hostname via the HTTP Host header.) The vulnerability can be triggered only if the Host header is not part of the web server routing process (e.g., if several domains are served by the same web server).  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-19  
Published
2016-10-31  
Modified Date
2016-11-28  
Seq
2016-7965  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
117781 21980 CVE-2016-7965 94237  View
117782 21980 CVE-2016-7965 https://github.com/splitbrain/dokuwiki/issues/1709  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
4935 JVNDB-2016-005708 DokuWiki におけるフィッシング攻撃を実行される脆弱性 DokuWiki は、パスワードリセットの URL として baseurl 設定の代わりに $_SERVER[HTTP_HOST] を使用するため、フィッシング攻撃を実行される脆弱性が存在します。 CVE-2016-7965 94472 CVE-2016-7965 21980 4.3 6.5 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-005708.html 2016-10-04 2016-11-07 View