XSS in Andreas Gohr Dokuwiki
CVE-2012-0283
Cross-site scripting (XSS) vulnerability in the tpl_mediaFileList function in inc/template.php in DokuWiki before 2012-01-25b allows remote attackers to inject arbitrary web script or HTML via the ns parameter in a medialist action to lib/exe/ajax.php.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.014 (68.8th percentile) — read the EPSS interpretation.
Affected products
- Andreas_gohr Dokuwiki — versions 2005-07-01, 2005-09-19, 2005-09-22
- N/a — versions n/a
Weakness classification (CWE)
References
- PSIRT-CNA@flexerasoftware.com (vdb-entry, x_refsource_BID)
- PSIRT-CNA@flexerasoftware.com (vendor-advisory, x_refsource_GENTOO)
- PSIRT-CNA@flexerasoftware.com (x_refsource_CONFIRM, Vendor Advisory)
- PSIRT-CNA@flexerasoftware.com (vendor-advisory, x_refsource_FEDORA)
- PSIRT-CNA@flexerasoftware.com (vendor-advisory, x_refsource_FEDORA)
- PSIRT-CNA@flexerasoftware.com (vendor-advisory, x_refsource_FEDORA)
- PSIRT-CNA@flexerasoftware.com (x_refsource_MISC, Vendor Advisory)