NetSight
IP …
medium5.3

CVE-2023-36674

An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x before 1.39.4, and 1.40.x before 1.40.1.

Impact

An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x before 1.39.4, and 1.40.x before 1.40.1. It is possible to bypass the Bad image list (aka badFile) by using the thumb parameter (aka Manualthumb) of the File syntax.

Affected products

VendorProductAffected versions
MediawikiMediawiki
before 1.35.11
from 1.36.0 before 1.38.7
from 1.39.0 before 1.39.4
Version 1.40.0

Weakness classification

CWE-20

References