CVE-2016-7964

NameCVE-2016-7964
DescriptionThe sendRequest method in HTTPClient Class in file /inc/HTTPClient.php in DokuWiki 2016-06-26a and older, when media file fetching is enabled, has no way to restrict access to private networks. This allows users to scan ports of internal networks via SSRF, such as 10.0.0.1/8, 172.16.0.0/12, and 192.168.0.0/16.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium (attack range: remote)
Debian Bugs844731

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
dokuwiki (PTS)wheezy, wheezy (security)0.0.20120125b-2+deb7u1vulnerable
jessie0.0.20140505.a+dfsg-4vulnerable
buster, sid0.0.20160626.a-2vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
dokuwikisource(unstable)(unfixed)medium844731

Notes

[jessie] - dokuwiki <no-dsa> (Minor issue)
[wheezy] - dokuwiki <no-dsa> (Minor issue)
https://github.com/splitbrain/dokuwiki/issues/1708

Search for package or bug name: Reporting problems