CVE-2014-8761 Missing authorization in n/a

Medium 5.0 Published 22 Oct 2014 Updated 6 Aug 2024

Remote attackers can access arbitrary images in DokuWiki due to insufficient access checks on media file details ajax calls.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2014-8761?

CVE-2014-8761 is a medium-severity missing authorization vulnerability in n/a, published on 22 Oct 2014. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

inc/template.php in DokuWiki before 2014-05-05a only checks for access to the root namespace, which allows remote attackers to access arbitrary images via a media file details ajax call.

Weakness: CWE-200

Which versions are affected by CVE-2014-8761?

It affects 1 product.

Products include Dokuwiki Dokuwiki.

How do I fix CVE-2014-8761?

Upgrade to a fixed version.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2014-8761 being exploited?

There is no known exploitation of CVE-2014-8761 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2014-8761, GHSA-j352-5rrc-rrwv.