CVE-2015-8627 — Improper Access Control in Mediawiki

CWE-284 — Improper Access Control5 documents5 sources

Severity

5.3MEDIUMNVD

EPSS

0.4%

top 37.45%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Mediawiki Debian Mediawiki

Timeline

PublishedMar 23

Latest updateMay 17

Description

MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly normalize IP addresses containing zero-padded octets, which might allow remote attackers to bypass intended access restrictions by using an IP address that was not supposed to have been allowed.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages3 packages

▶debiandebian/mediawiki< mediawiki 1:1.25.5-1 (bookworm)

▶Debianmediawiki/mediawiki< 1:1.25.5-1+3

▶NVDmediawiki/mediawiki1.23.11+10

Patches

Patch: www.openwall.com ↗Patch: www.openwall.com ↗Patch: lists.wikimedia.org ↗

🔴Vulnerability Details

GHSA

GHSA-325x-4hm2-p3wf: MediaWiki before 1↗2022-05-17

▶

OSV

CVE-2015-8627: MediaWiki before 1↗2017-03-23

▶

📋Vendor Advisories

Debian

CVE-2015-8627: mediawiki - MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x...↗2015

▶

💬Community

Bugzilla

CVE-2015-8622 CVE-2015-8623 CVE-2015-8624 CVE-2015-8625 CVE-2015-8626 CVE-2015-8627 CVE-2015-8628 mediawiki: multiple flaws fixed in 1.26.1, 1.25.4, 1.24.5, and 1.23.12↗2015-12-23

▶