CVE catalog

CVE-2016-7965

dokuwiki: CVE-2016-7965

[CVE catalog]

Severity
Low
Published
Source
[NVD] · [CVE record]
EPSS
1.21% · Oct 25, 2026

DokuWiki 2016-06-26a and older uses $_SERVER[HTTP_HOST] instead of the baseurl setting as part of the password-reset URL. This can lead to phishing attacks. (A remote unauthenticated attacker can change the URL's hostname via the HTTP Host header.) The vulnerability can be triggered only if the Host header is not part of the web server routing process (e.g., if several domains are served by the same web server).

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiandokuwikisid2026-07-14.c+dfsg-3fixed
Debiandokuwikiforky2026-07-14.c+dfsg-3fixed
Debiandokuwikitrixie2024-02-06b+dfsg-9fixed
Debiandokuwikibookworm0.0.20220731.a-2vulnerable
Ubuntudokuwiki16.040.0.20140929.d-1vulnerable
Ubuntudokuwiki16.040.0.20140929.d-1ubuntu1vulnerable
Ubuntudokuwiki18.040.0.20160626.a-2vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiandokuwikisourcesid2024-02-06b+dfsg-7unimportantNot reported[844732]
Debiandokuwikisourceforky2024-02-06b+dfsg-7unimportantNot reported[844732]
Debiandokuwikisourcetrixie2024-02-06b+dfsg-7unimportantNot reported[844732]
Debiandokuwikisourcebookworm(unfixed)unimportantNot reported[844732]

[Debian bug #844732]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [dokuwiki]Affected
    Details (2)

    • 0.0.20220731.a-2 · all · bookworm

      Affected

      dsa · dokuwiki · debian · bookworm; dsa · dokuwiki · debian · 12

    • 0.0.20220731.a-2 · all · bookworm

      Affected

      dsa · dokuwiki · debian · bookworm; dsa · dokuwiki · debian · 12

[Debian 13 (Trixie)]

  • [dokuwiki]Fixed
    Details (2)

    • 2024-02-06b+dfsg-9 · all · trixie

      Fixed · Fixed: 2024-02-06b+dfsg-7

      dsa · dokuwiki · debian · 13

    • 2024-02-06b+dfsg-9 · all · trixie

      Fixed · Fixed: 2024-02-06b+dfsg-7

      dsa · dokuwiki · debian · 13

  • [dokuwiki-farm]Fixed

    Source package: [dokuwiki]

    Details (2)

    • 2024-02-06b+dfsg-9 · all · trixie

      Fixed · Fixed: 2024-02-06b+dfsg-7

      dsa · dokuwiki · debian · 13

    • 2024-02-06b+dfsg-9 · all · trixie

      Fixed · Fixed: 2024-02-06b+dfsg-7

      dsa · dokuwiki · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]