Description

The chunked upload API (ApiUpload) in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not restrict the uploaded data to the claimed file size, which allows remote authenticated users to cause a denial of service via a chunk that exceeds the file size.

Remediation

References

CVE-2015-8001

Related Vulnerabilities

OpenSSL Cryptographic Issues Vulnerability (CVE-2011-5095)

WordPress Plugin Ultimate Member-User Profile, Registration, Login, Member Directory, Content Restriction & Membership Multiple Cross-Site Scripting Vulnerabilities (2.0.27)

WordPress Plugin WooCommerce PDF Vouchers-Ultimate Gift Cards Unspecified Vulnerability (4.9.4)

Drupal Core 4.7.x Multiple Vulnerabilities (4.7.0 - 4.7.1)

Moodle URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2019-14882)

Severity

Low

Tags

Missing Update Known Vulnerabilities CWE-284 CVE-2015-8001