CVE-2016-7965

DokuWiki 2016-06-26a and older uses $SERVERHTTPHOST instead of the baseurl setting as part of the password-reset URL. This can lead to phishing attacks. A remote unauthenticated attacker can change the URL's hostname via the HTTP Host header. The vulnerability can be triggered only if the Host...

UBUNTU-CVE-2016-7965

DokuWiki 2016-06-26a and older uses $SERVERHTTPHOST instead of the baseurl setting as part of the password-reset URL. This can lead to phishing attacks. A remote unauthenticated attacker can change the URL's hostname via the HTTP Host header. The vulnerability can be triggered only if the Host...

CVE-2016-7965

CVE-2016-7965 affects DokuWiki up to 2016-06-26a: password-reset URL construction uses $_SERVER[HTTP_HOST] instead of the configured baseurl. This allows a remote unauthenticated attacker to manipulate the password-reset URL hostname via the HTTP Host header, enabling phishing; exploitation requi...