Read the docs
TI-2004-02429 Aliases CVE-2004-2559GHSA-j2vj-gfj2-r9pm

DokuWiki before 2004-10-19 allows remote attackers to access administrative functionality…

Priority LOW 36Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

DokuWiki before 2004-10-19 allows remote attackers to access administrative functionality including (1) Mediaselectiondialog, (2) Recent changes, (3) feed, and (4) search, possibly due to the lack of ACL checks.

Why it matters now

EPSS 0.0159 75th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 11

CPEVersionsRoleVendor
cpe:2.3:a:andreas_gohr:dokuwiki:release_2004-07-04:*:*:*:*:*:*:*release_2004-07-04VulnerableAndreas Gohr
cpe:2.3:a:andreas_gohr:dokuwiki:release_2004-07-07:*:*:*:*:*:*:*release_2004-07-07VulnerableAndreas Gohr
cpe:2.3:a:andreas_gohr:dokuwiki:release_2004-07-12:*:*:*:*:*:*:*release_2004-07-12VulnerableAndreas Gohr
cpe:2.3:a:andreas_gohr:dokuwiki:release_2004-07-21:*:*:*:*:*:*:*release_2004-07-21VulnerableAndreas Gohr
cpe:2.3:a:andreas_gohr:dokuwiki:release_2004-07-25:*:*:*:*:*:*:*release_2004-07-25VulnerableAndreas Gohr
cpe:2.3:a:andreas_gohr:dokuwiki:release_2004-08-08:*:*:*:*:*:*:*release_2004-08-08VulnerableAndreas Gohr
cpe:2.3:a:andreas_gohr:dokuwiki:release_2004-08-15a:*:*:*:*:*:*:*release_2004-08-15aVulnerableAndreas Gohr
cpe:2.3:a:andreas_gohr:dokuwiki:release_2004-08-22:*:*:*:*:*:*:*release_2004-08-22VulnerableAndreas Gohr
cpe:2.3:a:andreas_gohr:dokuwiki:release_2004-09-12:*:*:*:*:*:*:*release_2004-09-12VulnerableAndreas Gohr
cpe:2.3:a:andreas_gohr:dokuwiki:release_2004-09-25:*:*:*:*:*:*:*release_2004-09-25VulnerableAndreas Gohr
  • cpe:2.3:a:andreas_gohr:dokuwiki:release_2004-07-04:*:*:*:*:*:*:* Versions release_2004-07-04 Vulnerable ·Andreas Gohr
  • cpe:2.3:a:andreas_gohr:dokuwiki:release_2004-07-07:*:*:*:*:*:*:* Versions release_2004-07-07 Vulnerable ·Andreas Gohr
  • cpe:2.3:a:andreas_gohr:dokuwiki:release_2004-07-12:*:*:*:*:*:*:* Versions release_2004-07-12 Vulnerable ·Andreas Gohr
  • cpe:2.3:a:andreas_gohr:dokuwiki:release_2004-07-21:*:*:*:*:*:*:* Versions release_2004-07-21 Vulnerable ·Andreas Gohr
  • cpe:2.3:a:andreas_gohr:dokuwiki:release_2004-07-25:*:*:*:*:*:*:* Versions release_2004-07-25 Vulnerable ·Andreas Gohr
  • cpe:2.3:a:andreas_gohr:dokuwiki:release_2004-08-08:*:*:*:*:*:*:* Versions release_2004-08-08 Vulnerable ·Andreas Gohr
  • cpe:2.3:a:andreas_gohr:dokuwiki:release_2004-08-15a:*:*:*:*:*:*:* Versions release_2004-08-15a Vulnerable ·Andreas Gohr
  • cpe:2.3:a:andreas_gohr:dokuwiki:release_2004-08-22:*:*:*:*:*:*:* Versions release_2004-08-22 Vulnerable ·Andreas Gohr
  • cpe:2.3:a:andreas_gohr:dokuwiki:release_2004-09-12:*:*:*:*:*:*:* Versions release_2004-09-12 Vulnerable ·Andreas Gohr
  • cpe:2.3:a:andreas_gohr:dokuwiki:release_2004-09-25:*:*:*:*:*:*:* Versions release_2004-09-25 Vulnerable ·Andreas Gohr
Show 1 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:andreas_gohr:dokuwiki:release_2004-09-30:*:*:*:*:*:*:*release_2004-09-30VulnerableAndreas Gohr
  • cpe:2.3:a:andreas_gohr:dokuwiki:release_2004-09-30:*:*:*:*:*:*:* Versions release_2004-09-30 Vulnerable ·Andreas Gohr

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2004-2559
  2. 2026-10-03 Alias added: GHSA-j2vj-gfj2-r9pm

References

Other 2

  • TI-2006-02786 The spellchecker (spellcheck.php) in DokuWiki 2006/06/04 and earlier allows remote… CVSS 2.0HIGH 7.5
  • TI-2004-02430 DokuWiki before 2004-10-19, when used on a web server that permits execution based on… CVSS 2.0HIGH 7.5
  • TI-2006-04915 lib/exec/fetch.php in DokuWiki before 2006-03-09e, when conf[imconvert] is configured to… CVSS 2.0HIGH 7.5
  • TI-2006-04521 Unrestricted file upload vulnerability in lib/exe/media.php in DokuWiki before… CVSS 2.0HIGH 7.5
  • TI-2006-04520 Direct static code injection vulnerability in doku.php in DokuWiki before 2006-030-09c… CVSS 2.0HIGH 7.5
  • TI-2012-01901 Cross-site request forgery (CSRF) vulnerability in doku.php in DokuWiki 2012-01-25 Angua… CVSS 2.0MEDIUM 6.8
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences