BIT-mediawiki-2023-36674
See a problem?- Import Source
- https://github.com/bitnami/vulndb/tree/main/data/mediawiki/BIT-mediawiki-2023-36674.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/BIT-mediawiki-2023-36674
- Aliases
- Published
- 2024-03-06T11:01:24.192Z
- Modified
- 2024-03-06T11:25:28.861Z
- Summary
- [none]
- Details
-
An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x before 1.39.4, and 1.40.x before 1.40.1. It is possible to bypass the Bad image list (aka badFile) by using the thumb parameter (aka Manualthumb) of the File syntax.
- Database specific
{ "cpes": [ "cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*", "cpe:2.3:a:mediawiki:mediawiki:1.40.0:*:*:*:*:*:*:*" ], "severity": "Medium" }- References
-
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2UIVGYECQGTUC2LLPVCZBPDLCTOHL2F6/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CHRX6DSLAMVXCV2YMJEWOLTBEYSESE5/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DOAXEGYBOEM4JWB4J3BDH73NK2LCYC3O/
- https://phabricator.wikimedia.org/T335612
Affected packages
Bitnami / mediawiki
Package
- Name
- mediawiki
- Purl
- pkg:bitnami/mediawiki
Severity
- 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator