CVE-2017-0371: High severity mediawiki vulnerability
MediaWiki before 1.23.16, 1.24.x through 1.27.x before 1.27.2, and 1.28.x before 1.28.1 allows remote attackers to discover the IP addresses of Wiki visitors via a style="background-image: attr(title url);" attack within a DIV element that has an attacker-controlled URL in the title attribute.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-0371?
CVE-2017-0371 is classified as a medium severity vulnerability due to its potential for information disclosure.
How do I fix CVE-2017-0371?
To fix CVE-2017-0371, upgrade MediaWiki to version 1.23.16, 1.27.2, or 1.28.1 or later.
Who is affected by CVE-2017-0371?
CVE-2017-0371 affects MediaWiki versions prior to 1.23.16, between 1.24.0 and 1.27.2, and between 1.28.0 and 1.28.1.
What type of attack does CVE-2017-0371 involve?
CVE-2017-0371 involves a remote attack that can exploit a specific attribute in a DIV element to expose IP addresses.
Is CVE-2017-0371 exploitable remotely?
Yes, CVE-2017-0371 can be exploited remotely by an attacker who controls the URL in the title attribute.