PT-2017-8961

CVE-2016-6331

Publicado

2016-09-16

Atualizado

2017-08-22

Descrição por

CVSS 3.1

7.5

Alta

MétricasAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki versions 1.23.0 through 1.23.14 MediaWiki versions 1.26.0 through 1.26.3 MediaWiki versions 1.27.0 through 1.27.0

Description The issue allows remote attackers to bypass intended per-title read restrictions. This is achieved via a parse action to the "api.php" endpoint.

Recommendations For MediaWiki versions 1.23.0 through 1.23.14, update to version 1.23.15 or later. For MediaWiki versions 1.26.0 through 1.26.3, update to version 1.26.4 or later. For MediaWiki versions 1.27.0 through 1.27.0, update to version 1.27.1 or later.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Tobias

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-284: Improper Access Control

Identificadores relacionados

CVE-2016-6331