CVE-2017-12979

Name of the Vulnerable Software and Affected Versions DokuWiki versions prior to 2017-02-19c

Description The issue concerns stored XSS when rendering a malicious language name in a code element, located in /inc/parser/xhtml.php. An attacker can create or edit a wiki with this element to trigger JavaScript execution.

Recommendations For versions prior to 2017-02-19c, update to a version newer than 2017-02-19c to resolve the issue. As a temporary workaround, consider restricting access to the /inc/parser/xhtml.php file to minimize the risk of exploitation. Avoid using malicious language names in code elements until the issue is resolved.