Description

An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x before 1.39.4, and 1.40.x before 1.40.1. It is possible to bypass the Bad image list (aka badFile) by using the thumb parameter (aka Manualthumb) of the File syntax.

Remediation

References

CVE-2023-36674

Related Vulnerabilities

Oracle Database Server CVE-2006-3698 Vulnerability (CVE-2006-3698)

Artifactory Improper Privilege Management Vulnerability (CVE-2022-0668)

WordPress Plugin WooCommerce Cart Expiration PHP Object Injection (0.1.0)

Python Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') Vulnerability (CVE-2004-0150)

WordPress Plugin wpCentral Privilege Escalation (1.5.0)

Severity

Medium

Classification

CVE-2023-36674 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Tags

Missing Update Known Vulnerabilities