CVE-2019-25338: 
Python vulnerability analysis and mitigation

CVE-2019-25338 is a username enumeration vulnerability in DokuWiki version 2018-04-22b, specifically within its password reset functionality. Unauthenticated remote attackers can submit arbitrary usernames to the password reset endpoint and distinguish between valid and invalid accounts by analyzing differential error response messages returned by the server. The vulnerability was formally published on February 12, 2026, and is classified under CWE-204 (Observable Response Discrepancy). It carries a CVSS v3.1 base score of 5.3 (Medium) (Feedly, Exploit-DB).

The root cause is an observable response discrepancy (CWE-204) in DokuWiki's password reset endpoint, where the application returns different error messages depending on whether a submitted username corresponds to an existing account. This allows an unauthenticated attacker to systematically probe the endpoint with candidate usernames and infer account validity from the server's responses — without requiring any credentials or special privileges. The attack vector is network-based, requires no user interaction, and has low attack complexity, making it trivially automatable. A public proof-of-concept exploit is available on Exploit-DB (EDB-47731) (Exploit-DB, Feedly).

Successful exploitation allows attackers to enumerate valid user accounts on a DokuWiki instance without any authentication. While the direct impact is limited to a low confidentiality breach (no integrity or availability impact), the enumerated account list can be leveraged for targeted phishing campaigns, credential stuffing, or brute-force attacks against specific known-valid usernames, increasing the risk of full account compromise as a secondary effect (Feedly).

A public proof-of-concept exploit is available on Exploit-DB (EDB-47731), demonstrating automated username enumeration against the affected endpoint (Exploit-DB). The vulnerability is detectable by Nessus (detection ID 299028). The EPSS score is approximately 0.03%, indicating a low probability of active exploitation in the near term. There is no current evidence of in-the-wild exploitation, threat actor attribution, or inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

1. Reconnaissance: Identify publicly accessible DokuWiki instances running version 2018-04-22b using web search engines, Shodan, or Censys by fingerprinting DokuWiki's default page structure.
2. Locate the password reset endpoint: Navigate to the password reset page, typically accessible at ?do=resendpwd or the equivalent URL on the target DokuWiki installation.
3. Submit candidate usernames: Using the public PoC (EDB-47731) or a custom script, submit a list of candidate usernames (e.g., common names, email addresses) to the password reset form.
4. Analyze differential responses: Compare the server's error messages for each submission — responses that differ between submitted usernames indicate whether an account exists (e.g., "User does not exist" vs. a different message or redirect for valid accounts).
5. Build a valid user list: Compile all usernames that triggered the "valid account" response pattern for use in subsequent targeted attacks such as phishing or brute-force login attempts (Exploit-DB, Feedly).

• Network: High volume of HTTP POST or GET requests to the DokuWiki password reset endpoint (?do=resendpwd) from a single IP or a rotating set of IPs in a short time window.
• Logs: Web server access logs showing repeated requests to the password reset URL with varying username parameters, especially with sequential or dictionary-based username patterns; unusual spikes in 200 or error responses from the reset endpoint.
• Behavioral: Automated request patterns (consistent timing intervals, no browser-like headers) targeting the password reset functionality from external sources (Feedly).

Update DokuWiki to a version released after 2018-04-22b, which addresses the differential response behavior. As a configuration-based workaround, ensure the password reset functionality returns identical, generic responses for both valid and invalid usernames to prevent information disclosure. Additionally, implement rate limiting or CAPTCHA on the password reset endpoint to slow automated enumeration attempts, and monitor access logs for patterns consistent with username enumeration activity (Feedly).