PT-2012-1871 · Wikimedia · Mediawiki

Tstarling · Publicado 2012-01-08 · Atualizado 2021-04-21 · CVE-2011-4361

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.17.1

Description The issue allows remote attackers to obtain sensitive information by leveraging certain functions or extensions, such as the SpecialUpload::ajaxGetExistsWarning function, or extensions like CategoryTree, ExtTab, and InlineEditor, due to a lack of read permission checks for action=ajax requests.

Recommendations For versions prior to 1.17.1, update to version 1.17.1 or later to resolve the issue.

Correção

Incorrect Default Permissions

Enumeração de Fraquezas

CWE-276

Identificadores relacionados

CVE-2011-4361

DSA-2366-1

Produtos afetados

Mediawiki

Referências · 11

• https://osv.dev/vulnerability/DEBIAN-CVE-2011-4361 · Aviso do Fabricante
• http://debian.org/security/2011/dsa-2366 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=758171 · Nota
• http://openwall.com/lists/oss-security/2011/11/29/12 · Nota
• https://bugzilla.wikimedia.org/show_bug.cgi?id=32616 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2011-4361 · Nota de Segurança
• http://lists.wikimedia.org/pipermail/mediawiki-announce/2011-November/000104.html · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2011-4361 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4361 · Nota
• http://openwall.com/lists/oss-security/2011/11/29/6 · Nota
• https://osv.dev/vulnerability/CVE-2011-4361 · Aviso do Fabricante