Input validation error in MediaWiki and Debian Linux - CVE-2017-8811
Published: November 15, 2017 / Updated: August 8, 2020
Vulnerability identifier: #VU37968
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-8811
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
The implementation of raw message parameter expansion in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows HTML mangling attacks.
Affected software
MediaWiki
Debian Linux
Arch Linux
Debian Linux
Arch Linux
How to mitigate CVE-2017-8811
Install update from vendor's website.