PT-2017-8961

CVE-2016-6331

Published

2016-09-16

Updated

2017-08-22

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki versions 1.23.0 through 1.23.14 MediaWiki versions 1.26.0 through 1.26.3 MediaWiki versions 1.27.0 through 1.27.0

Description The issue allows remote attackers to bypass intended per-title read restrictions. This is achieved via a parse action to the "api.php" endpoint.

Recommendations For MediaWiki versions 1.23.0 through 1.23.14, update to version 1.23.15 or later. For MediaWiki versions 1.26.0 through 1.26.3, update to version 1.26.4 or later. For MediaWiki versions 1.27.0 through 1.27.0, update to version 1.27.1 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Tobias

Vendors

Affected products

Weakness enumeration

CWE-284: Improper Access Control

Related identifiers

CVE-2016-6331