Improper access control in MediaWiki - CVE-2018-0505

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU14827

Improper access control in MediaWiki - CVE-2018-0505

Published: September 21, 2018


Vulnerability identifier: #VU14827
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-0505
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote authenticated attacker to bypass certain security restrictions.

The vulnerability exists due to incorrect validation of user privileges. A remote authenticated user with privileges to change user rights can bypass certain security controls.


Affected software

MediaWiki
mediawiki (Debian package)
mediawiki
Red Hat OpenShift Container Platform
Fedora

How to mitigate CVE-2018-0505

Install updates from vendor's website.

MediaWiki - addressed in versions 1.27.5, 1.29.3, 1.30.1, 1.31.1
mediawiki (Debian package) - update to 1:1.27.5-1~deb9u1
mediawiki - addressed in versions 1.29.3-1.fc27, 1.29.3-1.fc28, 1.29.3-1.fc29

External References

Related Security Bulletins