CVE-2017-0371

Name of the Vulnerable Software and Affected Versions MediaWiki versions 1.23.x through 1.23.15 MediaWiki versions 1.24.x through 1.27.x before 1.27.2 MediaWiki versions 1.28.x before 1.28.1

Description The issue allows remote attackers to discover the IP addresses of Wiki visitors via a style="background-image: attr(title url);" attack within a DIV element that has an attacker-controlled URL in the title attribute. This attack enables the disclosure of visitor IP addresses.

Recommendations For MediaWiki versions 1.23.x through 1.23.15, update to version 1.23.16 or later. For MediaWiki versions 1.24.x through 1.27.x before 1.27.2, update to version 1.27.2 or later. For MediaWiki versions 1.28.x before 1.28.1, update to version 1.28.1 or later.