CVE-2015-8001: XSS

First published: Tue Oct 20 2015(Updated: )

Several flaws were found in Mediawiki: * Wikipedia user RobinHood70 reported that the API failed to correctly stop adding new chunks to the upload when the reported size was exceeded, allowing a malicious users to upload add an infinite number of chunks for a single file upload. &lt;<a href="https://phabricator.wikimedia.org/T91203">https://phabricator.wikimedia.org/T91203</a>&gt; * Wikipedia user RobinHood70 also reported that a malicious user could upload chunks of 1 byte for very large files, potentially creating a very large number of files on the server's filesystem. &lt;<a href="https://phabricator.wikimedia.org/T91205">https://phabricator.wikimedia.org/T91205</a>&gt; * Internal review discovered that it is not possible to throttle file uploads. &lt;<a href="https://phabricator.wikimedia.org/T91850">https://phabricator.wikimedia.org/T91850</a>&gt; * Internal review discovered a missing authorization check when removing suppression from a revision. This allowed users with the 'viewsuppressed' user right but not the appropriate 'suppressrevision' user right to unsuppress revisions. &lt;<a href="https://phabricator.wikimedia.org/T95589">https://phabricator.wikimedia.org/T95589</a>&gt; * Richard Stanway from teamliquid.net reported that thumbnails of PNG files generated with ImageMagick contained the local file path in the image metadata. &lt;<a href="https://phabricator.wikimedia.org/T108616">https://phabricator.wikimedia.org/T108616</a>&gt; * Extension:PageTriage - MediaWiki user Grunny discovered a DOM-based XSS in the way the extension handled page titles. &lt;<a href="https://phabricator.wikimedia.org/T111029">https://phabricator.wikimedia.org/T111029</a>&gt; * Extension:Echo - Internal review discovered that Echo could display deleted or suppressed usernames when the username was previously used to Thank users. &lt;<a href="https://phabricator.wikimedia.org/T110553">https://phabricator.wikimedia.org/T110553</a>&gt; * Extension:OAuth - Wikipedia user Sitic discovered that the OAuth extension did not correctly enforce the IP restrictions of a Consumer when using previously negotiated credentials. &lt;<a href="https://phabricator.wikimedia.org/T103022">https://phabricator.wikimedia.org/T103022</a>&gt; * Extension:OAuth - Wikipedia user Sitic discovered that OAuth would accept a valid signature from any Consumer when checking the authorization signature. This allowed a registered Consumer who gained access to another Consumer's users' access tokens and secrets to use those credentials. &lt;<a href="https://phabricator.wikimedia.org/T103023">https://phabricator.wikimedia.org/T103023</a>&gt; CVE request and original report: <a href="http://seclists.org/oss-sec/2015/q4/104">http://seclists.org/oss-sec/2015/q4/104</a>

Credit: cve@mitre.org

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/type
• agent/first-publish-date
• collector/nvd-index
• agent/software-canonical-lookup-request
• agent/references
• agent/weakness
• agent/severity
• agent/author
• agent/remedy
• agent/softwarecombine
• agent/description
• collector/mitre-cve
• source/MITRE
• agent/last-modified-date
• agent/event
• collector/redhat-bugzilla
• source/Red Hat
• alias/CVE-2015-8001
• agent/software-canonical-lookup
• agent/tags
• agent/trending
• vendor/mediawiki
• canonical/mediawiki mediawiki
• version/mediawiki mediawiki/1.23.10
• version/mediawiki mediawiki/1.24.0
• version/mediawiki mediawiki/1.24.1
• version/mediawiki mediawiki/1.24.2
• version/mediawiki mediawiki/1.24.3
• version/mediawiki mediawiki/1.25.0
• version/mediawiki mediawiki/1.25.1
• version/mediawiki mediawiki/1.25.2
• package-manager/redhat