CVE-2015-8625

MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly sanitize parameters when calling the cURL…

published March 23, 2017

CVSS
—
EPSS
2%
Percentile
78.4
In the wild
Unconfirmed
What it is

MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly sanitize parameters when calling the cURL library, which allows remote attackers to read arbitrary files via an @ (at sign) character in unspecified POST array parameters.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01805 · 78.4th percentile
Published
2017-03-23T20:00Z
EPSS history
Timeline
  • 23 MAR 20:00Z
    MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly sanitize parameters when calling the cURL…
    cvelistv5