Mediawiki · Mediawiki · CVE-2017-0371
**Name of the Vulnerable Software and Affected Versions**
MediaWiki versions 1.23.x through 1.23.15
MediaWiki versions 1.24.x through 1.27.x before 1.27.2
MediaWiki versions 1.28.x before 1.28.1
**Description**
The issue allows remote attackers to discover the IP addresses of Wiki visitors via a style="background-image: attr(title url);" attack within a DIV element that has an attacker-controlled URL in the `title` attribute. This attack enables the disclosure of visitor IP addresses.
**Recommendations**
For MediaWiki versions 1.23.x through 1.23.15, update to version 1.23.16 or later.
For MediaWiki versions 1.24.x through 1.27.x before 1.27.2, update to version 1.27.2 or later.
For MediaWiki versions 1.28.x before 1.28.1, update to version 1.28.1 or later.