CVE-2011-0537
HIGH severity · CVSS 7.5 · Path traversal
7.5CVSS HIGH
Summary
Multiple directory traversal vulnerabilities in (1) languages/Language.php and (2) includes/StubObject.php in MediaWiki 1.8.0 and other versions before 1.16.2, when running on Windows and possibly Novell Netware, allow remote attackers to include and execute arbitrary local PHP files via vectors related to a crafted language file and the Language::factory function.
Impact & exploitability
Attack vectorNetwork
Attack complexityLow
Privileges required—
User interaction—
Confidentiality impact—
Integrity impact—
Availability impact—
Exploit probability (EPSS)3%
AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected products we track (1)
Recommendation
Apply the vendor fix promptly. Open any affected product above for its exact safe version.
Official patch: http://download.wikimedia.org/mediawiki/1.16/mediawiki-1.16.2.patch.gz ↗
Additional information
- NVD record
- http://download.wikimedia.org/mediawiki/1.16/mediawiki-1.16.2.patch.gzPatch
- http://lists.wikimedia.org/pipermail/mediawiki-announce/2011-February/000095.htmlPatch
- http://www.vupen.com/english/advisories/2011/0273Advisory
- http://osvdb.org/70798
- http://osvdb.org/70799
- http://www.openwall.com/lists/oss-security/2011/02/01/4
- http://www.openwall.com/lists/oss-security/2011/02/03/3
- https://bugzilla.wikimedia.org/show_bug.cgi?id=27094