Description

MediaWiki version older than 1.22.2, 1.21.5 and 1.19.11 are affected by a remote code execution vulnerability if file upload support for DjVu is enabled (natively supported by MediaWiki) or PDF file upload support is enabled (in combination with the PdfHandler extension). Neither file type is enabled by default in MediaWiki installations. If you are affected, we strongly urge you to update immediately.

Remediation

Update to the latest version of MediaWiki.

References

MediaWiki Security Releases: 1.22.2, 1.21.5 and 1.19.11

Related Vulnerabilities

WordPress Plugin WP Featured Post with thumbnail 'src' Parameter Cross-Site Scripting (3.0)

WordPress Plugin Ninja Forms Contact Form-The Drag and Drop Form Builder for WordPress Unspecified Vulnerability (2.9.24)

WordPress Plugin WP GPX Maps 'wp-gpx-maps_admin_tracks.php' Arbitrary File Upload (1.1.22)

WordPress Plugin Watu Quiz Cross-Site Scripting (3.1.2.4)

WordPress Plugin Securimage-WP Cross-Site Scripting (3.2.4)

Severity

High

Classification

CVE-2014-1610 CWE-20 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Tags

Code Execution Configuration Missing Update