CVE-2018-0504 Information disclosure in Special:Redirect/logid
MediumCVSS 6.5
EPSS 2.9%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains an information disclosure flaw in the Special:Redirect/logid
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mediawiki/core(Packagist) | >= 1.27.0, < 1.27.5 | 1.27.5 |
| mediawiki/core(Packagist) | = 1.27.0 | No fix listed |
| mediawiki/core(Packagist) | = 1.27.1 | No fix listed |
| mediawiki/core(Packagist) | = 1.27.2 | No fix listed |
| mediawiki/core(Packagist) | = 1.27.3 | No fix listed |
| mediawiki/core(Packagist) | = 1.27.4 | No fix listed |
| mediawiki/core(Packagist) | >= 1.29.0, < 1.29.3 | 1.29.3 |
| mediawiki/core(Packagist) | = 1.29.0 | No fix listed |
| mediawiki/core(Packagist) | = 1.29.1 | No fix listed |
| mediawiki/core(Packagist) | = 1.29.2 | No fix listed |
| mediawiki/core(Packagist) | >= 1.30.0, < 1.30.1 | 1.30.1 |
| mediawiki/core(Packagist) | = 1.30.0 | No fix listed |
| mediawiki/core(Packagist) | >= 1.31.0, < 1.31.1 | 1.31.1 |
| mediawiki/core(Packagist) | = 1.31.0 | No fix listed |
| debian/mediawiki(Debian:12) | < 1:1.31.1-1 | 1:1.31.1-1 |
| debian/mediawiki(Debian:14) | < 1:1.31.1-1 | 1:1.31.1-1 |
| debian/mediawiki(Debian:13) | < 1:1.31.1-1 | 1:1.31.1-1 |
| mediawiki | >= 1.31.0, < 1.31.1 | 1.31.1 |
| mediawiki | = 1.27.5 | No fix listed |
| mediawiki | = 1.29.3 | No fix listed |
| mediawiki | = 1.30.1 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| mediawiki | = before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- RHSA-2019:3238 vendor-advisory
- RHSA-2019:3813 vendor-advisory
- github.com exploit
- github.com product
- [wikitech-l] 20180920 Security release: 1.27.5 / 1.29.3 / 1.30.1 / 1.31.1 mailing-list patch vendor-advisory
- phabricator.wikimedia.org patch third-party-advisory
- DSA-4301 third-party-advisory vendor-advisory
- 1041695 third-party-advisory vdb-entry
- Debian Security Tracker CVE-2018-0504 vendor-advisory
- github.com