Design/Logic Flaw

MediaWiki before 1.17.1 does not check for read permission before handling action=ajax requests, which allows remote attackers to obtain sensitive information by 1 leveraging the SpecialUpload::ajaxGetExistsWarning function, or by 2 leveraging an extension, as demonstrated by the CategoryTree,...