UBUNTU-CVE-2015-8625
Dashboard / Vulnerabilities / UBUNTU-CVE-2015-8625
Summary:
Details: MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly sanitize parameters when calling the cURL library, which allows remote attackers to read arbitrary files via an @ (at sign) character in unspecified POST array parameters.
References: https://ubuntu.com/security/CVE-2015-8625, https://phabricator.wikimedia.org/T118032, https://www.cve.org/CVERecord?id=CVE-2015-8625
Affected packages
Package
Name: mediawiki
Purl: pkg:deb/ubuntu/mediawiki@1:1.27.4-3?arch=source&distro=bionic
Affected ranges
Type: ECOSYSTEM
Events:
Introduced- 0
Fixed -1:1.27.4-3
Affected versions
1:1.27.3-1
1:1.27.4-1
1:1.27.4-2
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
