CVE-2011-0537 — Path Traversal in Mediawiki

CWE-22 — Path Traversal4 documents4 sources
Severity
7.5HIGHNVD
EPSS
0.5%
top 33.21%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
MediawikiDebian Mediawiki
Timeline
PublishedFeb 4
Latest updateMay 17

Description

Multiple directory traversal vulnerabilities in (1) languages/Language.php and (2) includes/StubObject.php in MediaWiki 1.8.0 and other versions before 1.16.2, when running on Windows and possibly Novell Netware, allow remote attackers to include and execute arbitrary local PHP files via vectors related to a crafted language file and the Language::factory function.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages2 packages

▶NVDmediawiki/mediawiki42 versions+41

Patches

Patch: download.wikimedia.org ↗Patch: lists.wikimedia.org ↗Patch: download.wikimedia.org ↗

🔴Vulnerability Details

1
GHSA
GHSA-8vw9-c3gr-76x2: Multiple directory traversal vulnerabilities in (1) languages/Language↗2022-05-17
▶

📋Vendor Advisories

1
Debian
CVE-2011-0537: mediawiki - Multiple directory traversal vulnerabilities in (1) languages/Language.php and (...↗2011
▶

💬Community

1
Bugzilla
CVE-2011-0047 CVE-2011-0537 mediawiki: multiple vulnerabilities corrected in mediawiki 1.16.2↗2011-02-01
▶
CVE-2011-0537 — Path Traversal in Mediawiki | cvebase