PT-2010-2898 · Mediawiki · Mediawiki

Publicado 2010-03-31 · Atualizado 2013-09-13 · CVE-2010-1190

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.15.2

Description The issue allows remote attackers to bypass intended access restrictions and read private images. This is due to the failure of thumb.php to check user permissions before providing scaled images when used with access-restriction mechanisms.

Recommendations For versions prior to 1.15.2, update to version 1.15.2 or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2010-1190

DSA-2022-1

Produtos afetados

Mediawiki

Referências · 13

• http://debian.org/security/2010/dsa-2022 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-1190 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2010-1190 · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00006.html · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1190 · Nota
• http://secunia.com/advisories/39022 · Aviso do Fabricante
• http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-March/000088.html · Aviso do Fabricante
• http://vupen.com/english/advisories/2010/1001 · Nota
• http://secunia.com/advisories/39656 · Nota
• http://vupen.com/english/advisories/2010/0685 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2010-1190 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2010-1190 · Nota de Segurança
• http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_15_2/phase3/RELEASE-NOTES · Nota