Critical severity · published Sep 7, 2018
CVE-2018-15474
CSV Injection (aka Excel Macro Injection or Formula Injection) in /lib/plugins/usermanager/admin.php in DokuWiki 2018-04-22a and earlier allows remote attackers to exfiltrate…
9.6
CVSS
3.3%
EPSS
No
On KEV
Description
CSV Injection (aka Excel Macro Injection or Formula Injection) in /lib/plugins/usermanager/admin.php in DokuWiki 2018-04-22a and earlier allows remote attackers to exfiltrate sensitive data and to execute arbitrary code via a value that is mishandled in a CSV export. NOTE: the vendor has stated "this is not a security problem in DokuWiki.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)3.3% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DO
Dokuwiki · Dokuwiki
through 2018-04-22a · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-15474
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-15474
Exploit
https://github.com/splitbrain/dokuwiki/issues/2450
Exploit
https://seclists.org/fulldisclosure/2018/Sep/4
www.patreon.com
https://www.patreon.com/posts/unfixed-security-21250652
Exploit
https://www.sec-consult.com/en/blog/advisories/dokuwiki-csv-formula-injection-vulnerability/
More from Dokuwiki
8.6
CVE-2017-18123
The call parameter of /lib/exe/ajax.php in DokuWiki through 2017-02-19e does not properly encode user input, which leads to a reflected file download vulnerability, and allows…
8.6
CVE-2016-7964
The sendRequest method in HTTPClient Class in file /inc/HTTPClient.php in DokuWiki 2016-06-26a and older, when media file fetching is enabled, has no way to restrict access to…
7.5
CVE-2026-113356
DokuWiki before 2026-07-14c PHP Object Injection via Draft Race Condition
6.5
CVE-2016-7965
DokuWiki 2016-06-26a and older uses $_SERVER[HTTP_HOST] instead of the baseurl setting as part of the password-reset URL
6.1
CVE-2022-3123
Cross-site Scripting (XSS) - Reflected in GitHub repository splitbrain/dokuwiki prior to 2022-07-31a