PT-2011-1383 · Mediawiki · Mediawiki

Raphael Geissert · Published 2011-04-27 · Updated 2011-07-19 · CVE-2010-2789

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MediaWiki version 1.16 beta

Description A remote file inclusion issue in MediaWikiParserTest.php allows remote attackers to execute arbitrary PHP code when register globals is enabled.

Recommendations For MediaWiki version 1.16 beta, consider disabling the register globals setting as a temporary workaround until a patch is available.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2010-2789

Affected Products

Mediawiki

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2010-2789 · Security Note
• http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-July/000092.html · Vendor Advisory
• http://openwall.com/lists/oss-security/2010/07/29/4 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2789 · Note