CVE-2011-4361

MediaWiki before 1.17.1 does not check for read permission before handling action=ajax requests, which allows remote attackers to obtain sensitive information by 1 leveraging the SpecialUpload::ajaxGetExistsWarning function, or by 2 leveraging an extension, as demonstrated by the CategoryTree,...

CVE-2011-4361

MediaWiki before 1.17.1 does not check read permissions for action=ajax, enabling remote data leakage on private wikis. Exploitation can occur by abusing SpecialUpload::ajaxGetExistsWarning or via extensions such as CategoryTree, ExtTab, and InlineEditor. No explicit remediation is provided in th...

[SECURITY] [DSA 2366-1] mediawiki security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2366-1 [email protected] http://www.debian.org/security/ Jonathan Wiltshire December 18, 2011 http://www.debian.org/security/faq -...