CVE-2016-7964 | BDVDB-2026-79100 Detail

Description#

The sendRequest method in HTTPClient Class in file /inc/HTTPClient.php in DokuWiki 2016-06-26a and older, when media file fetching is enabled, has no way to restrict access to private networks. This allows users to scan ports of internal networks via SSRF, such as 10.0.0.1/8, 172.16.0.0/12, and 192.168.0.0/16.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://www.securityfocus.com/bid/94245
https://github.com/splitbrain/dokuwiki/issues/1708

Exploit#

No public exploit known

History#

Version 12016-10-31Record published in the CVE List.
Version 22024-08-06Most recent update recorded in the CVE List.