MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly sanitize parameters when calling the cURL library, which allows remote attackers to read arbitrary files via an @ (at sign) character in unspecified POST array parameters.
References
| Link | Resource |
|---|---|
| http://www.openwall.com/lists/oss-security/2015/12/21/8 | Mailing List Patch Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2015/12/23/7 | Mailing List Patch Third Party Advisory |
| https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-December/000186.html | Patch Release Notes Vendor Advisory |
| https://phabricator.wikimedia.org/T118032 | Patch Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2015/12/21/8 | Mailing List Patch Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2015/12/23/7 | Mailing List Patch Third Party Advisory |
| https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-December/000186.html | Patch Release Notes Vendor Advisory |
| https://phabricator.wikimedia.org/T118032 | Patch Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 02:38
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://www.openwall.com/lists/oss-security/2015/12/21/8 - Mailing List, Patch, Third Party Advisory | |
| References | () http://www.openwall.com/lists/oss-security/2015/12/23/7 - Mailing List, Patch, Third Party Advisory | |
| References | () https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-December/000186.html - Patch, Release Notes, Vendor Advisory | |
| References | () https://phabricator.wikimedia.org/T118032 - Patch, Third Party Advisory |
Information
Published : 2017-03-23 20:59
Updated : 2025-04-20 01:37
NVD link : CVE-2015-8625
Mitre link : CVE-2015-8625
CVE.ORG link : CVE-2015-8625
JSON object : View
Products Affected
mediawiki
- mediawiki
CWE
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor