CVE-2016-7965
DokuWiki 2016-06-26a and older uses $_SERVER[HTTP_HOST] instead of the baseurl setting as part of...
CVE-2016-7965 is a medium vulnerability (CVSS 6.5) in Dokuwiki, published October 31, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.21%, the 68th percentile. Fixed in dokuwiki 2024-02-06b+dfsg-7.
DokuWiki 2016-06-26a and older uses $_SERVER[HTTP_HOST] instead of the baseurl setting as part of the password-reset URL. This can lead to phishing attacks. (A remote unauthenticated attacker can change the URL's hostname via the HTTP Host header.) The vulnerability can be triggered only if the Host header is not part of the web server routing process (e.g., if several domains are served by the same web server).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
DokuWiki 2016-06-26a and older uses $_SERVER[HTTP_HOST] instead of the baseurl setting as part of the password-reset URL. This can lead to phishing attacks. (A remote unauthenticated attacker can change the URL's hostname via the HTTP Host header.) The vulnerability can be triggered only if the Host header is not part of the web server routing process (e.g., if several domains are served by the same web server).
- Record
CVE-2016-7965- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
DokuWiki 2016-06-26a and older uses $_SERVER[HTTP_HOST] instead of the baseurl setting as part of the password-reset URL. This can lead to phishing attacks. (A remote unauthenticated attacker can change the URL's hostname via the HTTP Host header.) The vulnerability can be triggered only if the Host header is not part of the web server routing process (e.g., if several domains are served by the same web server).
- Record
CVE-2016-7965- Updated
- 2026-11-02
EUVDEUVD-2016-8813 No score
DokuWiki 2016-06-26a and older uses $_SERVER[HTTP_HOST] instead of the baseurl setting as part of the password-reset URL. This can lead to phishing attacks. (A remote unauthenticated attacker can change the URL's hostname via the HTTP Host header.) The vulnerability can be triggered only if the Host header is not part of the web server routing process (e.g., if several domains are served by the same web server).
- Record
EUVD-2016-8813- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v8rc-559m-rv3h
DokuWiki 2016-06-26a and older uses $_SERVER[HTTP_HOST] instead of the baseurl setting as part of...
DokuWiki 2016-06-26a and older uses $_SERVER[HTTP_HOST] instead of the baseurl setting as part of the password-reset URL. This can lead to phishing attacks. (A remote unauthenticated attacker can change the URL's hostname via the HTTP Host header.) The vulnerability can be triggered only if the Host header is not part of the web server routing process (e.g., if several domains are served by the same web server).
- Record
GHSA-v8rc-559m-rv3h- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
DokuWiki 2016-06-26a and older uses $_SERVER[HTTP_HOST] instead of the baseurl setting as part of the password-reset URL. This can lead to phishing attacks. (A remote unauthenticated attacker can change the URL's hostname via the HTTP Host header.) The vulnerability can be triggered only if the Host header is not part of the web server routing process (e.g., if several domains are served by the same web server).
- Record
CVE-2016-7965- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-7965
DokuWiki 2016-06-26a and older uses $_SERVER[HTTP_HOST] instead of the baseurl setting as part of the password-reset URL. This can lead to phishing attacks. (A remote unauthenticated attacker can change the URL's hostname via the HTTP Host header.) The vulnerability can be triggered only if the Host header is not part of the web server routing process (e.g., if several domains are served by the same web server).
- Record
DEBIAN-CVE-2016-7965- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-7965
DokuWiki 2016-06-26a and older uses $_SERVER[HTTP_HOST] instead of the baseurl setting as part of the password-reset URL. This can lead to phishing attacks. (A remote unauthenticated attacker can change the URL's hostname via the HTTP Host header.) The vulnerability can be triggered only if the Host header is not part of the web server routing process (e.g., if several domains are served by the same web server).
- Record
UBUNTU-CVE-2016-7965- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dokuwikiDebian:12 |
All versions, plus listed versions 0.0.20220731.a-20.0.20220731.a-32024-02-06b+dfsg-0exp12024-02-06b+dfsg-0exp22024-02-06b+dfsg-1 Show 27 moreShow less2024-02-06b+dfsg-22024-02-06b+dfsg-32024-02-06b+dfsg-42024-02-06b+dfsg-52024-02-06b+dfsg-62024-02-06b+dfsg-72024-02-06b+dfsg-82024-02-06b+dfsg-92024-02-06b-0exp12024-02-06b-0exp22024-02-06b-0exp32024-02-06b-0exp42025-05-14+dfsg-12025-05-14.a+dfsg-12025-05-14.a+dfsg-22025-05-14.a+dfsg-32025-05-14.a+dfsg-42025-05-14.b+dfsg-12025-05-14.b+dfsg-22025-05-14.b+dfsg-32025-05-14.b+dfsg-42025-05-14.b+dfsg-52025-05-14.b+dfsg-62026-07-14+dfsg-12026-07-14.a+dfsg-12026-07-14.a+dfsg-22026-07-14a+dfsg-1 |
None known |
dokuwikiDebian:13 |
before 2024-02-06b+dfsg-7 | 2024-02-06b+dfsg-7 |
dokuwikiDebian:14 |
before 2024-02-06b+dfsg-7 | 2024-02-06b+dfsg-7 |
dokuwikiUbuntu:16.04:LTS |
All versions, plus listed versions 0.0.20140929.d-10.0.20140929.d-1ubuntu1 |
None known |
dokuwikiUbuntu:18.04:LTS |
All versions, plus listed versions 0.0.20160626.a-2 |
None known |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |