CVE-2019-25338

Name	CVE-2019-25338
Description	DokuWiki 2018-04-22b contains a username enumeration vulnerability in its password reset functionality that allows attackers to identify valid user accounts. Attackers can submit different usernames to the password reset endpoint and distinguish between existing and non-existing accounts by analyzing the server's error response messages.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
dokuwiki (PTS)	bullseye	0.0.20180422.a-2.1	undetermined
	bookworm	0.0.20220731.a-2	undetermined
	trixie	2024-02-06b+dfsg-9	undetermined
	forky, sid	2025-05-14.b+dfsg-5	undetermined

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
dokuwiki	source	(unstable)	undetermined

https://www.exploit-db.com/exploits/47731
check upstream status