----------------------------------------------------------------------



Accurate Vulnerability Scanning
No more false positives, no more false negatives

http://secunia.com/vulnerability_scanning/



----------------------------------------------------------------------

TITLE:
DokuWiki Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA38183

VERIFY ADVISORY:
http://secunia.com/advisories/38183/

DESCRIPTION:
Multiple vulnerabilities have been discovered in DokuWiki, which can
be exploited by malicious people to disclose sensitive information
and bypass certain security restrictions.

1) Input passed to the "ns" parameter in lib/plugins/acl/ajax.php
(when "ajax" is set to "tree") is not properly sanitised before being
used to list directories. This can be exploited to list contents of
arbitrary directories via directory traversal attacks.

2) A vulnerability is caused due to improper authentication in
lib/plugins/acl/ajax.php, which can be exploited to change the access
control rules and e.g. gain access to a closed wiki.

The vulnerabilities are confirmed in version 2009-12-25. Other
versions may also be affected.

SOLUTION:
Update to version 2009-12-25b or later.

PROVIDED AND/OR DISCOVERED BY:
white_sheep

ORIGINAL ADVISORY:
http://bugs.splitbrain.org/index.php?do=details&task_id=1847

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------