PT-2017-8967 · Wikimedia · Mediawiki

Bawolff · Published 2017-04-20 · Updated 2017-04-24 · CVE-2016-6337

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki versions 1.27.x before 1.27.1

Description The issue might allow remote attackers to bypass intended session access restrictions. This is achieved by leveraging a call to the UserGetRights function after Session::getAllowedUserRights.

Recommendations For MediaWiki versions 1.27.x before 1.27.1, update to version 1.27.1 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive areas of the application that rely on session access restrictions until the update can be applied.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2016-6337

Affected Products

Mediawiki

References · 7

• https://security-tracker.debian.org/tracker/CVE-2016-6337 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-6337 · Vendor Advisory
• https://phabricator.wikimedia.org/T139670 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2016-6337 · Security Note
• https://lists.wikimedia.org/pipermail/mediawiki-announce/2016-August/000195.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-6337 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6337 · Note