MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly sanitize parameters when calling the cURL library, which allows remote attackers to read arbitrary files via an @ (at sign) character in unspecified POST array parameters.
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Link | Tags |
---|---|
https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-December/000186.html | mailing list release notes patch vendor advisory |
http://www.openwall.com/lists/oss-security/2015/12/23/7 | mailing list third party advisory patch |
https://phabricator.wikimedia.org/T118032 | third party advisory patch |
http://www.openwall.com/lists/oss-security/2015/12/21/8 | mailing list third party advisory patch |