Description

MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly sanitize parameters when calling the cURL library, which allows remote attackers to read arbitrary files via an @ (at sign) character in unspecified POST array parameters.

Remediation

References

CVE-2015-8625

Related Vulnerabilities

Oracle JRE CVE-2013-5789 Vulnerability (CVE-2013-5789)

MySQL CVE-2017-3640 Vulnerability (CVE-2017-3640)

WordPress Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2003-1599)

PHP version older than 4.4.1

WordPress Plugin Chamber Dashboard Business Directory Cross-Site Scripting (3.2.8)

Severity

High

Classification

CVE-2015-8625 CWE-200 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities