Description
MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not properly restrict access to revisions, which allows remote authenticated users with the viewsuppressed user right to remove revision suppressions via a crafted revisiondelete action, which returns a valid a change form.
Remediation
References
Related Vulnerabilities
WordPress 4.5.3 Directory Traversal Vulnerability (4.5.3)
WordPress 4.7.x Arbitrary File Deletion Vulnerability (4.7 - 4.7.10)
Oracle Application Server CVE-2007-5520 Vulnerability (CVE-2007-5520)
Oracle Database Server CVE-2008-0344 Vulnerability (CVE-2008-0344)
WordPress Plugin Photo Gallery by 10Web-Mobile-Friendly Image Gallery SQL Injection (1.3.29)