CVE-2024-42758

A Cross-site Scripting (XSS) vulnerability exists in version v2024-01-05 of the indexmenu plugin when is used and enabled in Dokuwiki (Open Source Wiki Engine). A malicious attacker can input XSS payloads for example when creating or editing existing page, to trigger the XSS on Dokuwiki, which is then stored in .txt file (due to nature of how Dokuwiki is designed), which presents stored XSS.

CVSS v3.1

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

EPSS

0.76% chance of exploitation in the next 30 days, 53th percentile

Published

2024-08-16

Updated

2024-08-19

Proof-of-concept exploits (1)

• 1s1ldur/CVE-2024-427580★ · 2024-08-15

References

• CVE Record
• NVD entry

Related

• CVE-2024-42748
• CVE-2024-4278
• CVE-2024-42747
• CVE-2024-42812
• CVE-2024-42745
• CVE-2024-42813