CVE-2020-15005: Infoleak
In MediaWiki before 1.31.8, 1.32.x and 1.33.x before 1.33.4, and 1.34.x before 1.34.2, private wikis behind a caching server using the imgauth.php image authorization security feature may have had their files cached publicly, so any unauthorized user could view them. This occurs because Cache-Control and Vary headers were mishandled.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2020-15005?
CVE-2020-15005 is considered a medium severity vulnerability due to unauthorized access to private files on MediaWiki installations.
How do I fix CVE-2020-15005?
To mitigate CVE-2020-15005, upgrade MediaWiki to versions 1.31.8, 1.33.4, or 1.34.2 or later.
What systems are affected by CVE-2020-15005?
CVE-2020-15005 affects MediaWiki versions before 1.31.8, 1.32.x, 1.33.x before 1.33.4, and 1.34.x before 1.34.2.
Can unauthenticated users access files in private wikis due to CVE-2020-15005?
Yes, CVE-2020-15005 allows unauthorized users to access files cached publicly from private wikis.
Is there a known workaround for CVE-2020-15005?
There is no widely recognized workaround for CVE-2020-15005; upgrading to the fixed versions is recommended.