~ / search / GHSA-xpv7-93cm-4mxv

GHSA-xpv7-93cm-4mxv

img_auth.php may leak private extension images into the public cache

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-15005

Packages

EcosystemPackageAffectedFixed in
Packagist mediawiki/core < 1.31.8 1.31.8
Packagist mediawiki/core >= 1.32.0, < 1.33.4 1.33.4
Packagist mediawiki/core >= 1.34.0, < 1.34.2 1.34.2

Details

As written in the advisory (Markdown source, shown as plain text).

In MediaWiki before 1.31.8, 1.32.x and 1.33.x before 1.33.4, and 1.34.x before 1.34.2, private wikis behind a caching server using the img_auth.php image authorization security feature may have had their files cached publicly, so any unauthorized user could view them. This occurs because Cache-Control and Vary headers were mishandled.

References

External links from the advisory. They lead to third-party sites.