CVE-2019-25338
CVE-2019-25338 · Dokuwiki 2018-04-22b - Username Enumeration
This page contains facts from public vulnerability sources. Check the original advisory before updating.
DokuWiki 2018-04-22b contains a username enumeration vulnerability in its password reset functionality that allows attackers to identify valid user accounts. Attackers can submit different usernames to the password reset endpoint and distinguish between existing and non-existing accounts by analyzing the server's error response messages.
CVSS 6.9 · Medium · EPSS 0.5%
- Published
- Updated
Affected products and versions
dokuwiki
- Versions
- 2018-04-22b "Greebo": Affected
No fix published
dokuwiki PyPI
- Affected ranges
- ECOSYSTEM: ≤ 2018-04-22b
No fix published
dokuwiki Ubuntu:16.04:LTS
- Versions
- 0.0.20140929.d-1
- 0.0.20140929.d-1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
dokuwiki Ubuntu:18.04:LTS
- Versions
- 0.0.20160626.a-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
dokuwiki Ubuntu:20.04:LTS
- Versions
- 0.0.20180422.a-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
dokuwiki Ubuntu:22.04:LTS
- Versions
- 0.0.20180422.a-2.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
dokuwiki Ubuntu:24.04:LTS
- Versions
- 0.0.20220731.a-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
dokuwiki Ubuntu:25.10
- Versions
- 2024-02-06b+dfsg-4
- 2024-02-06b+dfsg-9
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
dokuwiki Ubuntu:26.10
- Versions
- 2025-05-14.b+dfsg-5
- 2025-05-14.b+dfsg-6
- 2026-07-14.a+dfsg-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
dokuwiki Ubuntu:26.04:LTS
- Versions
- 2024-02-06b+dfsg-9
- 2025-05-14.a+dfsg-4
- 2025-05-14.b+dfsg-1
- 2025-05-14.b+dfsg-2
- 2025-05-14.b+dfsg-3
- 2025-05-14.b+dfsg-4
- 2025-05-14.b+dfsg-5
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published