PT-2011-2430 · Mediawiki+2 · Mediawiki+2

Happy Melon · Publicado 2011-02-04 · Atualizado 2011-02-12 · CVE-2011-0537

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MediaWiki versions 1.8.0 through 1.16.2

Description The issue concerns directory traversal vulnerabilities in MediaWiki, specifically in the languages/Language.php and includes/StubObject.php files. These vulnerabilities can be exploited by remote attackers to include and execute arbitrary local PHP files. The exploitation is related to crafted language files and the Language::factory function. The issue is relevant when MediaWiki is running on Windows and possibly Novell Netware.

Recommendations For MediaWiki versions 1.8.0 through 1.16.2, update to version 1.16.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the Language::factory function and limiting the ability to upload or modify language files until a patch is applied. Additionally, restrict access to sensitive PHP files to minimize the risk of exploitation.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2011-0537

Produtos afetados

Mediawiki

Novell Netware

Windows

Referências · 10

• http://download.wikimedia.org/mediawiki/1.16/mediawiki-1.16.2.patch.gz · Correção
• http://lists.wikimedia.org/pipermail/mediawiki-announce/2011-February/000095.html · Correção
• http://osvdb.org/70799 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0537 · Nota
• http://openwall.com/lists/oss-security/2011/02/03/3 · Nota
• http://openwall.com/lists/oss-security/2011/02/01/4 · Nota
• https://bugzilla.wikimedia.org/show_bug.cgi?id=27094 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-0537 · Nota de Segurança
• http://vupen.com/english/advisories/2011/0273 · Aviso do Fabricante
• http://osvdb.org/70798 · Nota