Description

The chunked upload API (ApiUpload) in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 allows remote authenticated users to cause a denial of service (disk consumption) via a file upload using one byte chunks.

Remediation

References

CVE-2015-8002

Related Vulnerabilities

Ruby on Rails Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2011-2931)

WordPress 4.9.x Multiple Vulnerabilities (4.9 - 4.9.4)

Jboss EAP Improper Restriction of XML External Entity Reference Vulnerability (CVE-2019-10172)

Grafana Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2022-23498)

Joomla! Core 1.0.x Multiple Cross-Site Scripting Vulnerabilities (1.0.0 - 1.0.12)

Severity

Medium

Classification

CVE-2015-8002

Tags

Missing Update Known Vulnerabilities