cbcvebase.
CVE-2015-2937
published 2015-04-13

CVE-2015-2937: MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM or Zend PHP, allows remote attackers to cause a denial of service…

PriorityP429high7.1CVSS 2.0
AVNACMAuNCNINAC
EPSS
2.69%
84.3th percentile
MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM or Zend PHP, allows remote attackers to cause a denial of service ("quadratic blowup" and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, a different vulnerability than CVE-2015-2942.

Affected

54 ranges· showing 25
VendorProductVersion rangeFixed in
debianmediawiki< mediawiki 1:1.19.20+dfsg-2.3 (bookworm)mediawiki 1:1.19.20+dfsg-2.3 (bookworm)
mediawikimediawiki<= 1.19.23—
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki——

CVSS provenance

nvdv2.07.1HIGHAV:N/AC:M/Au:N/C:N/I:N/A:C
osv7.1HIGH
vendor_debian7.1LOW
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.