[arch-security] [ASA-201412-19] dokuwiki: cross-site scripting
anthraxx at archlinux.org
Tue Dec 16 15:19:24 UTC 2014
Arch Linux Security Advisory ASA-201412-19
Date : 2014-12-16
CVE-ID : CVE-2014-9253
Package : dokuwiki
Type : cross-site scripting
Remote : Yes
Link : https://wiki.archlinux.org/index.php/CVE-2014
The package dokuwiki before version 20140929_b-1 is vulnerable to
Upgrade to 20140929_b-1.
# pacman -Syu "dokuwiki>=20140929_b-1"
The problem has been fixed upstream in version 20140929_b.
It was discovered that dokuwiki did not sufficiently filter uploaded
files. A remote attacker with upload access is able to use this flaw in
order to upload SWF files leading to possible cross-site scripting.
A remote attacker with upload access is able to craft a SWF file to
perform a cross-site scripting attack.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 819 bytes
Desc: OpenPGP digital signature
More information about the arch-security