Lucene search

DebianCVELIST:CVE-2017-0372

HistoryApr 06, 2017 - 12:00 a.m.

CVE-2017-0372 Parameters injection in SyntaxHighlight results in multiple vulnerabilities

2017-04-0600:00:00

debian

www.cve.org

9.7 High

AI Score

Confidence

High

0.835 High

EPSS

Percentile

98.5%

JSON

Parameters injection in the SyntaxHighlight extension of Mediawiki before 1.23.16, 1.27.3 and 1.28.2 might result in multiple vulnerabilities.

CNA Affected

[
  {
    "product": "mediawiki (SyntaxHighlight extension)",
    "vendor": "mediawiki",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]

References

bugs.debian.org/861585

lists.wikimedia.org/pipermail/mediawiki-announce/2017-April/000207.html

lists.wikimedia.org/pipermail/mediawiki-announce/2017-April/000209.html

phabricator.wikimedia.org/T158689

security-tracker.debian.org/tracker/CVE-2017-0372