Description

MediaWiki version older than 1.22.2, 1.21.5 and 1.19.11 are affected by a remote code execution vulnerability if file upload support for DjVu is enabled (natively supported by MediaWiki) or PDF file upload support is enabled (in combination with the PdfHandler extension). Neither file type is enabled by default in MediaWiki installations. If you are affected, we strongly urge you to update immediately.

Remediation

Update to the latest version of MediaWiki.

References

MediaWiki Security Releases: 1.22.2, 1.21.5 and 1.19.11

Related Vulnerabilities

Piwigo Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2021-40317)

WordPress Plugin VideoWhisper Video Presentation 'vw_upload.php' Arbitrary File Upload (3.17)

WordPress Plugin WP Database Backup Cross-Site Scripting (3.3)

OpenSSL NULL Pointer Dereference Vulnerability (CVE-2023-0216)

MySQL Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2020-2922)

Severity

High

Classification

CVE-2014-1610 CWE-20 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Tags

Code Execution Configuration Missing Update