CVE-2015-8005

UNKNOWN

MediaWiki before 1

Published Nov 9, 2015

Modified 1 years ago

Details

MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 uses the thumbnail ImageMagick command line argument, which allows remote attackers to obtain the installation path by reading the metadata of a PNG thumbnail file.

References

WEB

http://www.securitytracker.com/id/1034028

WEB

https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-October/000181.html

WEB

https://phabricator.wikimedia.org/T108616

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2015-8005

CVSS Analysis

CVSS v2.0

5.0

Exploitability

Access Vector

NetworkAV:N

Access Complexity

LowAC:L

Authentication

NoneAu:N

Impact

Confidentiality

PartialC:P

Integrity

NoneI:N

Availability

NoneA:N

5/AV:N/AC:L/Au:N/C:P/I:N/A:N

Ecosystems

Timeline

PublishedNov 9, 2015

ModifiedAug 6, 2024