DokuWiki 2018-04-22b is susceptible to a username enumeration vulnerability, allowing unauthenticated attackers to confirm the existence of specific user accounts on the system.

This vulnerability occurs in the password reset endpoint, where the application returns different error messages depending on whether the submitted username exists in the database. This allows unauthenticated attackers to systematically verify valid account names, which is a critical precursor to targeted credential attacks.

Successful exploitation allows an attacker to map the user directory of the DokuWiki instance. This information significantly lowers the barrier for subsequent brute-force or credential-stuffing attacks against identified accounts. Given the CVSS score of 7.5, this vulnerability represents a high risk to organizational security, particularly if the wiki contains sensitive internal documentation or is integrated with centralized authentication systems.

Immediate Action: Upgrade to the latest stable release of DokuWiki. If an immediate upgrade is not feasible, restrict access to the password reset functionality via network-level controls.

Proactive Monitoring: Review web server access logs for repeated POST requests to the password reset endpoint from single IP addresses or abnormal patterns of requests containing varying username parameters.

Compensating Controls: Implement a Web Application Firewall (WAF) to detect and block automated requests that trigger distinct error patterns associated with username enumeration.

Public Exploit Available: Yes, a proof-of-concept is available via Exploit-DB (EDB-ID: 47731).

The ability for an attacker to enumerate valid usernames is a significant security lapse that facilitates targeted exploitation. Administrators should prioritize upgrading their DokuWiki instance to a patched version immediately. In the interim, ensure that the application's error reporting is minimized and monitor for signs of automated enumeration attempts.