PT-2020-6807 · Mediawiki +1 · Mediawiki +1

🗓️ 24 Jun 2020 00:00:00Reported by Positive TechnologiesType

ptsecurity

ptsecurity🔗 dbugs.ptsecurity.com👁 3 Views

Public caching of protected wiki images due to Cache-Control and Vary headers in img auth.php.

Reporter	Title	Published	Views	Family All 400
ALT Linux	Security fix for the ALT Linux 10 package firejail version 0.9.62.4-alt1	19 Aug 202000:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 9 package mediawiki version 1.35.1-alt1	30 Dec 202000:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 9 package mediawiki version 1.35.0-alt1	14 Oct 202000:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 9 package mediawiki version 1.34.2-alt1	1 Aug 202000:00	–	altlinux
ATTACKERKB	CVE-2020-15005	24 Jun 202023:15	–	attackerkb
ArchLinux	[ASA-202101-22] mediawiki: multiple issues	12 Jan 202100:00	–	archlinux
BDU FSTEC	Vulnerability of the check_output function in output.c. SUID in a isolated programming environment. Firejail, due to the lack of measures to neutralize special elements, allows a violator to access confidential data, compromise its integrity, and cause service failures.	30 Mar 202100:00	–	bdu_fstec
BDU FSTEC	Vulnerability of the check_output function in output.c. SUID in a isolated programming environment. Firejail, due to the lack of measures to neutralize special elements, allows a violator to access confidential data, compromise its integrity, and cause service failures.	30 Mar 202100:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the software for implementing the hypertext environment MediaWiki, related to the disclosure of information, allows a violator to gain access to confidential data.	30 Mar 202100:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the BlockLogFormatter.php component of the MediaWiki software environment, related to the shortcomings in the security measures for handling web page structures, allows attackers to compromise the integrity of data.	30 Mar 202100:00	–	bdu_fstec

Source	Link
cve	www.cve.mitre.org/cgi-bin/cvename.cgi
cve	www.cve.mitre.org/cgi-bin/cvename.cgi
cve	www.cve.mitre.org/cgi-bin/cvename.cgi
security-tracker	www.security-tracker.debian.org/tracker/CVE-2020-15005
cve	www.cve.org/CVERecord
osv	www.osv.dev/vulnerability/GHSA-xpv7-93cm-4mxv
bdu	www.bdu.fstec.ru/vul/2021-01771
security-tracker	www.security-tracker.debian.org/tracker/source-package/mediawiki
cve	www.cve.mitre.org/cgi-bin/cvename.cgi
cve	www.cve.mitre.org/cgi-bin/cvename.cgi

06 Mar 2024 00:00Current

6.2Medium risk

Vulners AI Score6.2

CVSS 3.13.1 - 9.8

CVSS 27.5

EPSS0.04098

mediawiki cache control vary headers image authorization private wikis protected information