CVE-2017-0371

published 2022-02-18

CVE-2017-0371: MediaWiki before 1.23.16, 1.24.x through 1.27.x before 1.27.2, and 1.28.x before 1.28.1 allows remote attackers to discover the IP addresses of Wiki visitors…

Priority P3 43 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C H I N A N

MediaWiki before 1.23.16, 1.24.x through 1.27.x before 1.27.2, and 1.28.x before 1.28.1 allows remote attackers to discover the IP addresses of Wiki visitors via a style="background-image: attr(title url);" attack within a DIV element that has an attacker-controlled URL in the title attribute.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
debian	mediawiki	< mediawiki 1:1.27.2-1 (bookworm)	mediawiki 1:1.27.2-1 (bookworm)
mediawiki	mediawiki	< 1.23.16	1.23.16
mediawiki	mediawiki	>= 0 < 1:1.27.2-1	1:1.27.2-1
mediawiki	mediawiki	>= 0 < 1:1.27.2-1	1:1.27.2-1
mediawiki	mediawiki	>= 0 < 1:1.27.2-1	1:1.27.2-1
mediawiki	mediawiki	>= 0 < 1:1.27.2-1	1:1.27.2-1
mediawiki	mediawiki	>= 1.24.0 < 1.27.2	1.27.2
mediawiki	mediawiki	>= 1.28.0 < 1.28.1	1.28.1

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:P/I:N/A:N

osv 7.5 HIGH

vendor_debian 7.5 HIGH

vendor_redhat 7.5 HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.