CVE-2011-1580
LOW severity · CVSS 3.5 · Improper input validation
3.5CVSS LOW
Summary
The transwiki import functionality in MediaWiki before 1.16.3 does not properly check privileges, which allows remote authenticated users to perform imports from any wgImportSources wiki via a crafted POST request.
Impact & exploitability
Attack vectorNetwork
Attack complexity—
Privileges required—
User interaction—
Confidentiality impactNone
Integrity impact—
Availability impactNone
Exploit probability (EPSS)2%
AV:N/AC:M/Au:S/C:N/I:P/A:N
Affected products we track (1)
Recommendation
Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.
Official patch: http://lists.wikimedia.org/pipermail/mediawiki-announce/2011-April/000096.html ↗
Additional information
- NVD record
- http://lists.wikimedia.org/pipermail/mediawiki-announce/2011-April/000096.htmlPatch
- http://openwall.com/lists/oss-security/2011/04/13/15Patch
- http://secunia.com/advisories/44142Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058588.html
- http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058910.html
- http://lists.fedoraproject.org/pipermail/package-announce/2011-April/059232.html
- http://lists.fedoraproject.org/pipermail/package-announce/2011-April/059235.html
- http://www.debian.org/security/2011/dsa-2366