oss-sec mailing list archives
CVE request: Server-side arbitrary script inclusion vulnerability in MediaWiki <=1.16.1
From: Reed Loden <reed () reedloden com>
Date: Tue, 1 Feb 2011 15:36:25 -0800
Greetings, MediaWiki 1.16.2 was just released as a security update for two vulnerabilities. One already has a CVE, but this one still needs one: "An arbitrary script inclusion vulnerability was discovered. The vulnerability only allows execution of files with names ending in ".php" which are already present in the local filesystem. Only servers running Microsoft Windows and possibly Novell Netware are affected. Despite these mitigating factors, all users are advised to upgrade, since there is a risk of complete server compromise. MediaWiki 1.8.0 and later is affected. For more details, see bug 27094" https://bugzilla.wikimedia.org/show_bug.cgi?id=27094 Thanks, ~reed -- Reed Loden reed () reedloden com
Current thread:
- CVE request: Server-side arbitrary script inclusion vulnerability in MediaWiki <=1.16.1 Reed Loden (Feb 01)
- Re: CVE request: Server-side arbitrary script inclusion vulnerability in MediaWiki <=1.16.1 Josh Bressers (Feb 03)