cbcvebase.
CVE-2015-8627
published 2017-03-23

CVE-2015-8627: MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly normalize IP addresses containing zero-padded…

PriorityP428medium5.3CVSS 3.0
AVNACLPRNUINSUCNILAN
EPSS
1.36%
68.9th percentile
MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly normalize IP addresses containing zero-padded octets, which might allow remote attackers to bypass intended access restrictions by using an IP address that was not supposed to have been allowed.

Affected

16 ranges
VendorProductVersion rangeFixed in
debianmediawiki< mediawiki 1:1.25.5-1 (bookworm)mediawiki 1:1.25.5-1 (bookworm)
mediawikimediawiki<= 1.23.11—
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki>= 0 < 1:1.25.5-11:1.25.5-1
mediawikimediawiki>= 0 < 1:1.25.5-11:1.25.5-1
mediawikimediawiki>= 0 < 1:1.25.5-11:1.25.5-1
mediawikimediawiki>= 0 < 1:1.25.5-11:1.25.5-1

CVSS provenance

nvdv3.05.3MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
osv5.3MEDIUM
vendor_debian5.3LOW
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.