CVE catalog

CVE-2016-7964

dokuwiki: CVE-2016-7964

[CVE catalog]

Severity
Low
Published
Source
[NVD] · [CVE record]
EPSS
2.09% · Oct 25, 2026

The sendRequest method in HTTPClient Class in file /inc/HTTPClient.php in DokuWiki 2016-06-26a and older, when media file fetching is enabled, has no way to restrict access to private networks. This allows users to scan ports of internal networks via SSRF, such as 10.0.0.1/8, 172.16.0.0/12, and 192.168.0.0/16.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiandokuwikisid2026-07-14.c+dfsg-3fixed
Debiandokuwikiforky2026-07-14.c+dfsg-3fixed
Debiandokuwikitrixie2024-02-06b+dfsg-9fixed
Debiandokuwikibookworm0.0.20220731.a-2vulnerable
Ubuntudokuwiki16.040.0.20140929.d-1vulnerable
Ubuntudokuwiki16.040.0.20140929.d-1ubuntu1vulnerable
Ubuntudokuwiki18.040.0.20160626.a-2vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiandokuwikisourcesid2024-02-06b+dfsg-7unimportantNot reported[844731]
Debiandokuwikisourceforky2024-02-06b+dfsg-7unimportantNot reported[844731]
Debiandokuwikisourcetrixie2024-02-06b+dfsg-7unimportantNot reported[844731]
Debiandokuwikisourcebookworm(unfixed)unimportantNot reported[844731]

[Debian bug #844731]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [dokuwiki]Affected
    Details (2)

    • 0.0.20220731.a-2 · all · bookworm

      Affected

      dsa · dokuwiki · debian · bookworm; dsa · dokuwiki · debian · 12

    • 0.0.20220731.a-2 · all · bookworm

      Affected

      dsa · dokuwiki · debian · bookworm; dsa · dokuwiki · debian · 12

[Debian 13 (Trixie)]

  • [dokuwiki]Fixed
    Details (2)

    • 2024-02-06b+dfsg-9 · all · trixie

      Fixed · Fixed: 2024-02-06b+dfsg-7

      dsa · dokuwiki · debian · 13

    • 2024-02-06b+dfsg-9 · all · trixie

      Fixed · Fixed: 2024-02-06b+dfsg-7

      dsa · dokuwiki · debian · 13

  • [dokuwiki-farm]Fixed

    Source package: [dokuwiki]

    Details (2)

    • 2024-02-06b+dfsg-9 · all · trixie

      Fixed · Fixed: 2024-02-06b+dfsg-7

      dsa · dokuwiki · debian · 13

    • 2024-02-06b+dfsg-9 · all · trixie

      Fixed · Fixed: 2024-02-06b+dfsg-7

      dsa · dokuwiki · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]