Description

MediaWiki version older than 1.22.2, 1.21.5 and 1.19.11 are affected by a remote code execution vulnerability if file upload support for DjVu is enabled (natively supported by MediaWiki) or PDF file upload support is enabled (in combination with the PdfHandler extension). Neither file type is enabled by default in MediaWiki installations. If you are affected, we strongly urge you to update immediately.

Remediation

Update to the latest version of MediaWiki.

References

MediaWiki Security Releases: 1.22.2, 1.21.5 and 1.19.11

Related Vulnerabilities

WordPress Plugin RokIntroScroller Multiple Vulnerabilities (1.8)

WordPress Plugin PeepSo-User Profile and Social Networking Privilege Escalation (1.6.0)

WordPress Plugin Shortlinks by Pretty Links-Best WordPress Link Tracking Multiple Vulnerabilities (2.1.9)

WordPress Plugin Gallery-Flagallery Photo Portfolio 'facebook.php' Cross-Site Scripting (1.56)

WordPress Plugin Kish Guest Posting 'uploadify.php' Arbitrary File Upload (1.2)

Severity

High

Classification

CVE-2014-1610 CWE-20 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Tags

Code Execution Configuration Missing Update