CVE-2017-0372: Parameters injection in SyntaxHighlight results in multiple vulnerabilities
Parameters injection in the SyntaxHighlight extension of Mediawiki before 1.23.16, 1.27.3 and 1.28.2 might result in multiple vulnerabilities.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/mediawikito a version that resolves this vulnerability.Fixed in 1:1.35.13-1+deb11u2Fixed in 1:1.35.13-1+deb11u6Fixed in 1:1.39.17-1~deb12u1Fixed in 1:1.43.6+dfsg-1~deb13u1Fixed in 1:1.43.6+dfsg-2
Event History
Frequently Asked Questions
What is the severity of CVE-2017-0372?
CVE-2017-0372 is considered to have multiple potential vulnerabilities due to parameter injection in the SyntaxHighlight extension of MediaWiki.
How do I fix CVE-2017-0372?
To fix CVE-2017-0372, upgrade MediaWiki to versions 1.23.16, 1.27.3, or 1.28.2 and later.
What versions of MediaWiki are affected by CVE-2017-0372?
CVE-2017-0372 affects MediaWiki versions prior to 1.23.16, 1.27.3, and 1.28.2.
Is CVE-2017-0372 exploitable remotely?
Yes, CVE-2017-0372 has the potential for remote exploitation due to parameter injection vulnerabilities.
What are the consequences of CVE-2017-0372 if exploited?
Exploitation of CVE-2017-0372 may lead to unauthorized actions which could compromise the integrity of the MediaWiki instance.