CVE-2008-5688: Infoleak
MediaWiki 1.8.1, and other versions before 1.13.3, when the wgShowExceptionDetails variable is enabled, sometimes provides the full installation path in a debugging message, which might allow remote attackers to obtain sensitive information via unspecified requests that trigger an uncaught exception.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MediaWikito a version that resolves this vulnerability.Fixed in 1.13.3 - Configuration
Disable detailed exception output by setting the MediaWiki configuration variable wgShowExceptionDetails to false to avoid disclosing the full installation path in error messages.
MediaWiki wgShowExceptionDetails = false
Event History
Frequently Asked Questions
What is the severity of CVE-2008-5688?
CVE-2008-5688 is classified as having a moderate severity level due to the potential exposure of sensitive information.
How do I fix CVE-2008-5688?
To fix CVE-2008-5688, you should update to MediaWiki version 1.13.3 or later, where the issue is resolved.
What versions of MediaWiki are affected by CVE-2008-5688?
CVE-2008-5688 affects MediaWiki versions from 1.8.1 up to, but not including, 1.13.3.
What happens if I do not address CVE-2008-5688?
If CVE-2008-5688 is not addressed, attackers may exploit the vulnerability to obtain sensitive information from the server.
What is the impact of enabling wgShowExceptionDetails in relation to CVE-2008-5688?
Enabling wgShowExceptionDetails in MediaWiki can lead to the disclosure of the full installation path in debug messages, increasing information leakage risks.