PT-2010-2898 · Mediawiki · Mediawiki

Published 2010-03-31 · Updated 2013-09-13 · CVE-2010-1190

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.15.2

Description The issue allows remote attackers to bypass intended access restrictions and read private images. This is due to the failure of thumb.php to check user permissions before providing scaled images when used with access-restriction mechanisms.

Recommendations For versions prior to 1.15.2, update to version 1.15.2 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2010-1190

DSA-2022-1

Affected Products

Mediawiki

References · 13

• http://debian.org/security/2010/dsa-2022 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-1190 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2010-1190 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00006.html · Vendor Advisory
• http://secunia.com/advisories/39022 · Vendor Advisory
• http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-March/000088.html · Vendor Advisory
• http://vupen.com/english/advisories/2010/0685 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2010-1190 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-1190 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1190 · Note
• http://vupen.com/english/advisories/2010/1001 · Note
• http://secunia.com/advisories/39656 · Note
• http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_15_2/phase3/RELEASE-NOTES · Note