CVE-2017-0372: Parameters injection in SyntaxHighlight results in multiple vulnerabilities
Published Apr 13, 2018
·Updated
Parameters injection in the SyntaxHighlight extension of Mediawiki before 1.23.16, 1.27.3 and 1.28.2 might result in multiple vulnerabilities.
Affected Software
9 affected componentsFixes available
MediaWiki MediaWiki<=1.23.15
MediaWiki MediaWiki=1.27.0
MediaWiki MediaWiki=1.27.1
MediaWiki MediaWiki=1.27.2
MediaWiki MediaWiki=1.28.0
MediaWiki MediaWiki=1.28.1
Debian Debian Linux=7.0
Debian Debian Linux=9.0
debian/mediawiki
1:1.35.13-1+deb11u21:1.35.13-1+deb11u61:1.39.17-1~deb12u11:1.43.6+dfsg-1~deb13u11:1.43.6+dfsg-2
Remediation
Event History
Apr 13, 2018
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
DescriptionWeakness
Feb 19, 2026
Data Sourced
via Debian·07:27 PM
DescriptionAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2017-0372?
CVE-2017-0372 is considered to have multiple potential vulnerabilities due to parameter injection in the SyntaxHighlight extension of MediaWiki.
2
How do I fix CVE-2017-0372?
To fix CVE-2017-0372, upgrade MediaWiki to versions 1.23.16, 1.27.3, or 1.28.2 and later.
3
What versions of MediaWiki are affected by CVE-2017-0372?
CVE-2017-0372 affects MediaWiki versions prior to 1.23.16, 1.27.3, and 1.28.2.
4
Is CVE-2017-0372 exploitable remotely?
Yes, CVE-2017-0372 has the potential for remote exploitation due to parameter injection vulnerabilities.
5
What are the consequences of CVE-2017-0372 if exploited?
Exploitation of CVE-2017-0372 may lead to unauthorized actions which could compromise the integrity of the MediaWiki instance.