LiveActive security incident?Get immediate response
CVE Record

CVE-2017-18123: The call parameter of /lib/exe/ajax.php in DokuWiki through 2017-02-19e does not properly encode user input...

The call parameter of /lib/exe/ajax.php in DokuWiki through 2017-02-19e does not properly encode user input, which leads to a reflected file download vulnerability, and allows remote attackers to run arbitrary programs.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

DokuWiki versions through 2017-02-19e mishandled input in an AJAX endpoint. A remote attacker could abuse reflected file download behavior to make unsafe content appear as a downloadable file, potentially leading a user to run a program. No source in the bundle confirms active exploitation.

Executive priority

Treat this as a targeted maintenance priority for any legacy DokuWiki estate. It is not KEV-listed in the supplied data, but the potential arbitrary program execution impact justifies prompt upgrade or exposure reduction.

Technical view

The issue is in the call parameter of /lib/exe/ajax.php, where user input was not properly encoded. The CVE describes a reflected file download vulnerability with potential arbitrary program execution impact. Public references include upstream GitHub discussion, a commit, HackerOne report, VulnHive entry, and Debian LTS security advisories.

Likely exposure

Exposure is most likely on DokuWiki deployments running versions through 2017-02-19e, especially internet-accessible wikis. The supplied affected-products metadata is incomplete, so validation should rely on installed DokuWiki version and vendor or distro package history.

Exploitation context

The source bundle does not show KEV listing or active exploitation. The described attack is remote and tied to crafted input reflected through an AJAX endpoint. Practical impact may depend on browser behavior and user interaction, but the bundle does not provide complete prerequisites.

Researcher notes

The CVE metadata lacks CVSS, CWE, and structured affected CPEs. Analysis should stay anchored to DokuWiki through 2017-02-19e and the referenced upstream and Debian materials. Do not infer exploitation in the wild from the public references alone.

Mitigation direction

  • Inventory all DokuWiki instances and identify versions through 2017-02-19e.
  • Apply relevant upstream DokuWiki or Debian security updates from vendor guidance.
  • Review the referenced upstream commit and pull request for fix provenance.
  • Reduce public exposure for outdated DokuWiki instances until patched.
  • Monitor vendor and distribution advisories for any follow-up fixes.

Validation and detection

  • Confirm the installed DokuWiki version on each wiki host.
  • Check whether /lib/exe/ajax.php is present and externally reachable.
  • Verify package changelogs include the relevant DokuWiki security update.
  • Confirm remediation against upstream GitHub commit 238b8e878ad48f370903465192b57c2072f65d86.
  • Review web logs for unusual requests targeting /lib/exe/ajax.php call parameters.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2017-18123 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
8Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.