Description

MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote authenticated users with undelete permissions to bypass intended suppressrevision and deleterevision restrictions and remove the revision deletion status of arbitrary file revisions by using Special:Undelete.

Remediation

References

CVE-2016-6336

Related Vulnerabilities

Piwigo Improper Access Control Vulnerability (CVE-2016-10105)

WordPress Plugin Permalink Manager Lite Cross-Site Request Forgery (2.2.19.2)

MySQL Use of Externally-Controlled Format String Vulnerability (CVE-2009-2446)

Liferay DXP Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-38265)

WordPress Plugin Simple Social Media Share Buttons-Social Sharing for Everyone Unspecified Vulnerability (3.2.0)

Severity

Medium

Classification

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Tags

Missing Update Known Vulnerabilities CWE-284 CVE-2016-6336