DokuWiki 'conf/mime.conf' Cross Site Scripting Vulnerability

Bugtraq ID:	71671
Class:	Input Validation Error
CVE:	CVE-2014-9253
Remote:	Yes
Local:	No
Published:	Dec 15 2014 12:00AM
Updated:	May 07 2015 05:23PM
Credit:	Kacper Szurek
Vulnerable:	Mandriva Business Server 1 X86 64 Mandriva Business Server 1 DokuWiki DokuWiki 2007.6.26 DokuWiki DokuWiki 2006.11.6 DokuWiki DokuWiki 2006.6.4 DokuWiki DokuWiki 2006.3.9 DokuWiki DokuWiki 2006.3.5 DokuWiki DokuWiki 2005.9.22 DokuWiki DokuWiki 2014-09-29 DokuWiki DokuWiki 2014-05-05a DokuWiki DokuWiki 2014-05-05 DokuWiki DokuWiki 2013-12-08 DokuWiki DokuWiki 2012-01-25b DokuWiki DokuWiki 2012-01-25a DokuWiki DokuWiki 2012-01-25 DokuWiki DokuWiki 2011-05-25C DokuWiki DokuWiki 2011-05-25a DokuWiki DokuWiki 2011-05-25 DokuWiki DokuWiki 2010-11-07a DokuWiki DokuWiki 2009-12-25c DokuWiki DokuWiki 2009-12-25b DokuWiki DokuWiki 2009-12-25 DokuWiki DokuWiki 2009-02-14b DokuWiki DokuWiki 2009-02-14 DokuWiki DokuWiki 2008-05-05 DokuWiki DokuWiki 2007.06.26b DokuWiki DokuWiki 2007-07-13 DokuWiki DokuWiki 2007-06-26 DokuWiki DokuWiki 2006.03.09e DokuWiki DokuWiki 2006.03.09b DokuWiki DokuWiki 2006-11-06 DokuWiki DokuWiki 2006-03-09 DokuWiki DokuWiki 2006-03-05 DokuWiki DokuWiki 2005-09-22 DokuWiki DokuWiki 2005-09-19 DokuWiki DokuWiki 2005-07-13 DokuWiki DokuWiki 2005-07-01 DokuWiki DokuWiki 2004-10-19 DokuWiki DokuWiki 2004-09-30 DokuWiki DokuWiki 2004-09-25 DokuWiki DokuWiki 2004-09-12 DokuWiki DokuWiki 2004-08-22 DokuWiki DokuWiki 2004-08-15a DokuWiki DokuWiki 2004-08-15 DokuWiki DokuWiki 2004-08-08 DokuWiki DokuWiki 2004-07-25 DokuWiki DokuWiki 2004-07-21
Not Vulnerable:	DokuWiki DokuWiki 2014-09-29b

DokuWiki 'conf/mime.conf' Cross Site Scripting Vulnerability

DokuWiki is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to DokuWiki 2014-09-29b are vulnerable.

DokuWiki 'conf/mime.conf' Cross Site Scripting Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.


Mandriva Business Server 1 X86 64

• Mandriva dokuwiki-20140929-1.4.mbs1.noarch.rpm
  http://www.mandriva.com/en/downloads/