CVE-2015-2935: Infoleak
Published Apr 13, 2015
·Updated
MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to bypass the SVG filtering and obtain sensitive user information via a mixed case @import in a style element in an SVG file, as demonstrated by "@imporT."
Affected Software
49 affected components
MediaWiki MediaWiki<=1.19.23
MediaWiki MediaWiki=1.20
MediaWiki MediaWiki=1.20.1
MediaWiki MediaWiki=1.20.2
MediaWiki MediaWiki=1.20.3
MediaWiki MediaWiki=1.20.4
MediaWiki MediaWiki=1.20.5
MediaWiki MediaWiki=1.20.6
MediaWiki MediaWiki=1.20.7
MediaWiki MediaWiki=1.20.8
MediaWiki MediaWiki=1.21
MediaWiki MediaWiki=1.21.1
MediaWiki MediaWiki=1.21.2
MediaWiki MediaWiki=1.21.3
MediaWiki MediaWiki=1.21.4
MediaWiki MediaWiki=1.21.5
MediaWiki MediaWiki=1.21.6
MediaWiki MediaWiki=1.21.7
MediaWiki MediaWiki=1.21.8
MediaWiki MediaWiki=1.21.9
MediaWiki MediaWiki=1.21.10
MediaWiki MediaWiki=1.21.11
MediaWiki MediaWiki=1.22.0
MediaWiki MediaWiki=1.22.1
MediaWiki MediaWiki=1.22.2
MediaWiki MediaWiki=1.22.3
MediaWiki MediaWiki=1.22.4
MediaWiki MediaWiki=1.22.5
MediaWiki MediaWiki=1.22.6
MediaWiki MediaWiki=1.22.7
MediaWiki MediaWiki=1.22.8
MediaWiki MediaWiki=1.22.9
MediaWiki MediaWiki=1.22.10
MediaWiki MediaWiki=1.22.11
MediaWiki MediaWiki=1.22.12
MediaWiki MediaWiki=1.22.13
MediaWiki MediaWiki=1.22.14
MediaWiki MediaWiki=1.22.15
MediaWiki MediaWiki=1.23.0
MediaWiki MediaWiki=1.23.1
MediaWiki MediaWiki=1.23.2
MediaWiki MediaWiki=1.23.3
MediaWiki MediaWiki=1.23.4
MediaWiki MediaWiki=1.23.5
MediaWiki MediaWiki=1.23.6
MediaWiki MediaWiki=1.23.7
MediaWiki MediaWiki=1.23.8
MediaWiki MediaWiki=1.24.0
MediaWiki MediaWiki=1.24.1
Remediation
Event History
Apr 13, 2015
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-2935?
CVE-2015-2935 is classified as a medium severity vulnerability.
2
How do I fix CVE-2015-2935?
To fix CVE-2015-2935, upgrade to MediaWiki version 1.19.24, 1.23.9, or 1.24.2 or later.
3
What type of vulnerability is CVE-2015-2935?
CVE-2015-2935 is a security vulnerability that allows remote attackers to bypass SVG filtering.
4
Which versions of MediaWiki are affected by CVE-2015-2935?
CVE-2015-2935 affects MediaWiki versions before 1.19.24, 1.23.9, and 1.24.2.
5
What are the potential consequences of CVE-2015-2935?
Exploitation of CVE-2015-2935 may lead to sensitive user information leakage.