Description

MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to bypass the SVG filtering and obtain sensitive user information via a mixed case @import in a style element in an SVG file, as demonstrated by "@imporT."

Remediation

References

CVE-2015-2935

Related Vulnerabilities

WordPress Plugin SP Project & Document Manager Multiple SQL Injection Vulnerabilities (2.4.3)

WordPress Plugin Local Market Explorer 'api-key' Parameter Cross-Site Scripting (3.1.1)

Apache Tomcat Other Vulnerability (CVE-2011-2481)

Oracle JRE CVE-2020-2756 Vulnerability (CVE-2020-2756)

XWiki Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') Vulnerability (CVE-2023-29511)

Severity

Medium

Classification

CVE-2015-2935 CWE-200

Tags

Missing Update Known Vulnerabilities