VulnerabilityModified

CVE-2014-9253

The default file type whitelist configuration in conf/mime.conf in the Media Manager in DokuWiki before 2014-09-29b allows remote attackers to execute arbitrary web script or HTML by uploading an SWF file, then accessing it via the media parameter to…

MEDIUM 4.3EPSS 2.37%

Does this matter?

Lower severity and a low EPSS score (2.37%). Track it; it rarely justifies an emergency change on its own.

Description

CVSS 2.0: 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS: 2.37% probability · 83th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: dokuwiki/dokuwiki · mageia/mageia
Source: cve@mitre.org

References

http://advisories.mageia.org/MGASA-2014-0540.htmlThird Party Advisory
http://seclists.org/oss-sec/2014/q4/1050Third Party Advisory, VDB Entry
http://security.szurek.pl/dokuwiki-20140929a-xss.htmlThird Party Advisory
http://www.securityfocus.com/bid/71671Not Applicable
http://www.securitytracker.com/id/1031369Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/99291
https://github.com/splitbrain/dokuwiki/commit/778ddf6f2cd9ed38b9db2d73e823b8c21243a960Issue Tracking, Patch
https://www.dokuwiki.org/changesRelease Notes
http://advisories.mageia.org/MGASA-2014-0540.htmlThird Party Advisory
http://seclists.org/oss-sec/2014/q4/1050Third Party Advisory, VDB Entry
http://security.szurek.pl/dokuwiki-20140929a-xss.htmlThird Party Advisory
http://www.securityfocus.com/bid/71671Not Applicable
http://www.securitytracker.com/id/1031369Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/99291
https://github.com/splitbrain/dokuwiki/commit/778ddf6f2cd9ed38b9db2d73e823b8c21243a960Issue Tracking, Patch
https://www.dokuwiki.org/changesRelease Notes

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.