CVE-2017-8809 api.php in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 has a Reflected File Download vulnerability.
CriticalCVSS 9.8
EPSS 7.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
api.php in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 has a Reflected File Download vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/mediawiki(Debian:12) | < 1:1.27.4-1 | 1:1.27.4-1 |
| debian/mediawiki(Debian:13) | < 1:1.27.4-1 | 1:1.27.4-1 |
| debian/mediawiki(Debian:14) | < 1:1.27.4-1 | 1:1.27.4-1 |
| mediawiki | <= 1.27.3 | No fix listed |
| mediawiki | = 1.28.0 | No fix listed |
| mediawiki | = 1.28.1 | No fix listed |
| mediawiki | = 1.28.2 | No fix listed |
| mediawiki | = 1.29.0 | No fix listed |
| mediawiki | = 1.29.1 | No fix listed |
| debian linux | = 9.0 | No fix listed |
References
- Debian Security Tracker CVE-2017-8809 vendor-advisory
- 1039812 third-party-advisory vdb-entry
- lists.wikimedia.org mailing-list patch vendor-advisory
- DSA-4036 third-party-advisory vendor-advisory