medium5.9
CVE-2014-9481
The Scribunto extension for MediaWiki allows remote attackers to obtain the rollback token and possibly other sensitive information via a crafted module, relat…
Impact
The Scribunto extension for MediaWiki allows remote attackers to obtain the rollback token and possibly other sensitive information via a crafted module, related to unstripping special page HTML.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mediawiki | Mediawiki | before 1.19.23 from 1.19.24 before 1.22.15 from 1.23.0 before 1.23.8 from 1.23.9 before 1.24.1 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.openwall.com/lists/oss-security/2014/12/21/2
- http://www.openwall.com/lists/oss-security/2015/01/03/13
- https://lists.wikimedia.org/pipermail/mediawiki-announce/2014-December/000173.html
- https://phabricator.wikimedia.org/T73167
- http://www.openwall.com/lists/oss-security/2014/12/21/2
- http://www.openwall.com/lists/oss-security/2015/01/03/13
- https://lists.wikimedia.org/pipermail/mediawiki-announce/2014-December/000173.html
- https://phabricator.wikimedia.org/T73167