PT-2014-4255

CVE-2014-1610

Publicado

2014-01-30

Atualizado

2016-05-25

Descrição por

CVSS 2.0

6.0

Média

MétricasAV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MediaWiki versions 1.19.x through 1.19.10 MediaWiki versions 1.21.x through 1.21.4 MediaWiki versions 1.22.x through 1.22.1

Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in certain parameters, such as the page parameter to "includes/media/DjVu.php" and the w parameter (also known as the width field) to "thumb.php", which is not properly handled by "includes/media/PdfHandler body.php".

Recommendations For MediaWiki versions 1.19.x through 1.19.10, update to version 1.19.11 or later. For MediaWiki versions 1.21.x through 1.21.4, update to version 1.21.5 or later. For MediaWiki versions 1.22.x through 1.22.1, update to version 1.22.2 or later.

Explorabilidade

Exploit

Correção

Impactos

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-20: Improper Input Validation

Identificadores relacionados

CVE-2014-1610

ALT-PU-2014-1172

DSA-2891-1