CVE-2017-0372 Parameters injection in SyntaxHighlight results in multiple vulnerabilities
CriticalCVSS 9.8
EPSS 11.3%
Framework module
- Published
- Updated
- Exploit status
- Public exploit available
Description
Parameters injection in the SyntaxHighlight extension of Mediawiki before 1.23.16, 1.27.3 and 1.28.2 might result in multiple vulnerabilities.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/mediawiki(Debian:12) | < 1:1.27.3-1 | 1:1.27.3-1 |
| debian/mediawiki(Debian:13) | < 1:1.27.3-1 | 1:1.27.3-1 |
| debian/mediawiki(Debian:14) | < 1:1.27.3-1 | 1:1.27.3-1 |
| mediawiki | <= 1.23.15 | No fix listed |
| mediawiki | = 1.27.0 | No fix listed |
| mediawiki | = 1.27.1 | No fix listed |
| mediawiki | = 1.27.2 | No fix listed |
| mediawiki | = 1.28.0 | No fix listed |
| mediawiki | = 1.28.1 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| mediawiki (SyntaxHighlight extension) | All versions | No fix listed |
References
- Debian Security Tracker CVE-2017-0372 issue-tracking third-party-advisory vendor-advisory
- bugs.debian.org issue-tracking third-party-advisory
- [mediawiki-announce] 20170406 Security Release: 1.28.1 / 1.27.2 / 1.23.16 mailing-list patch release-notes vendor-advisory
- [mediawiki-announce] 20170430 Security release 1.27.3 and 1.28.2 mailing-list patch release-notes vendor-advisory
- phabricator.wikimedia.org exploit third-party-advisory