CVE-2014-8764 Auth bypass in n/a

Medium 5.0 Published 22 Oct 2014 Updated 6 Aug 2024

Remote attackers can bypass authentication in DokuWiki when using Active Directory LDAP by sending null characters, gaining unauthorized access.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2014-8764?

CVE-2014-8764 is a medium-severity authentication bypass vulnerability in n/a, published on 22 Oct 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

DokuWiki 2014-05-05a and earlier, when using Active Directory for LDAP authentication, allows remote attackers to bypass authentication via a user name and password starting with a null (\0) character, which triggers an anonymous bind.

Weakness: CWE-287

Which versions are affected by CVE-2014-8764?

It affects 2 products.

Products include Dokuwiki Dokuwiki, Mageia Project Mageia.

How do I fix CVE-2014-8764?

Upgrade to a fixed version.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2014-8764 being exploited?

There is no known exploitation of CVE-2014-8764 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2014-8764, GHSA-5pq8-pcjm-mv95.