PT-2012-1871 · Wikimedia · Mediawiki

Tstarling · Published 2012-01-08 · Updated 2021-04-21 · CVE-2011-4361

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.17.1

Description The issue allows remote attackers to obtain sensitive information by leveraging certain functions or extensions, such as the SpecialUpload::ajaxGetExistsWarning function, or extensions like CategoryTree, ExtTab, and InlineEditor, due to a lack of read permission checks for action=ajax requests.

Recommendations For versions prior to 1.17.1, update to version 1.17.1 or later to resolve the issue.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2011-4361

DSA-2366-1

Affected Products

Mediawiki

References · 11

• https://osv.dev/vulnerability/DEBIAN-CVE-2011-4361 · Vendor Advisory
• http://debian.org/security/2011/dsa-2366 · Vendor Advisory
• https://bugzilla.wikimedia.org/show_bug.cgi?id=32616 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-4361 · Security Note
• http://lists.wikimedia.org/pipermail/mediawiki-announce/2011-November/000104.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2011-4361 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2011-4361 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=758171 · Note
• http://openwall.com/lists/oss-security/2011/11/29/12 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4361 · Note
• http://openwall.com/lists/oss-security/2011/11/29/6 · Note