CVE-2017-0372: debian debian_linux Injection
Vulnerability summary
CVE-2017-0372 is a critical (CVSS 9.8) Injection vulnerability in debian debian_linux. EPSS estimates a 11.27% chance of exploitation in the next 30 days, higher than 95.9% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 13-04-2018PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
Parameters injection in the SyntaxHighlight extension of Mediawiki before 1.23.16, 1.27.3 and 1.28.2 might result in multiple vulnerabilities.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
11.27%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
+0.96 pp
From 10.31% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (phabricator.wikimedia.org)
Maturity: unknown
MediaWiki SyntaxHighlight extension option injection vulnerability
exploit/multi/http/mediawiki_syntaxhighlight
Maturity: weaponized
Weaknesses
CWE · root causeAffected systems
Debian2 products
- mediawiki< 1:1.27.3-1
- debian_linuxEOL7.0 | 9.0
Mediawiki2 products
- mediawiki≤ 1.23.15 | 1.27.0 | 1.27.1 | 1.27.2 | 1.28.0 | 1.28.1
- mediawiki (syntaxhighlight extension)n/a
Ubuntu1 product
- mediawiki< 1:1.27.4-3
3 vendors · 5 products
References
7 links- lists.wikimedia.org/pipermail/mediawiki-announce/2017-April/000207.htmlMailing ListX Refsource MLISTPatchRelease NotesVendor AdvisoryREPORT
- lists.wikimedia.org/pipermail/mediawiki-announce/2017-April/000209.htmlMailing ListX Refsource MLISTPatchRelease NotesVendor Advisory
- security-tracker.debian.org/tracker/CVE-2017-0372X Refsource CONFIRMIssue TrackingThird Party AdvisoryAdvisory