PT-2022-7878
CVE-2017-0371
·
تاريخ النشر
2017-08-22
·
تاريخ التحديث
2022-02-28
الوصف من
CVSS 3.1
7.5
عاليةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions
MediaWiki versions 1.23.x through 1.23.15
MediaWiki versions 1.24.x through 1.27.x before 1.27.2
MediaWiki versions 1.28.x before 1.28.1
Description
The issue allows remote attackers to discover the IP addresses of Wiki visitors via a style="background-image: attr(title url);" attack within a DIV element that has an attacker-controlled URL in the
title attribute. This attack enables the disclosure of visitor IP addresses.Recommendations
For MediaWiki versions 1.23.x through 1.23.15, update to version 1.23.16 or later.
For MediaWiki versions 1.24.x through 1.27.x before 1.27.2, update to version 1.27.2 or later.
For MediaWiki versions 1.28.x before 1.28.1, update to version 1.28.1 or later.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾