MGASA-2017-0110: mediawiki Mageia

CVSS: UnknownPublished
Published 16-04-2017Last modified 16-04-2026
Open JSON

Vulnerability summary

MGASA-2017-0110 is a vulnerability in mediawiki Mageia with no CVSS score yet.

Overall risk
0/100
0100
Minimal · default modelHow is this calculated?
CVSS score
Not scored
010
No CVSS score recorded
EPSS score
Not scored
0%100%
No EPSS score yet
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 9 · Downstream 0
CVE-2017-0361CVE-2017-0362CVE-2017-0363CVE-2017-0364CVE-2017-0365CVE-2017-0366

Timeline

  1. 16-04-2017
    PublishedVulnerability first disclosed.
  2. 16-04-2026
    Last modifiedVulnerability information updated.

Description

Updated mediawiki packages fix security vulnerability API parameters may now be marked as "sensitive" to keep their values out of the logs (CVE-2017-0361). "Mark all pages visited" on the watchlist now requires a CSRF token (CVE-2017-0362). Special:UserLogin and Special:Search allow redirect to interwiki links (CVE-2017-0363, CVE-2017-0364). XSS in SearchHighlighter::highlightText() when $wgAdvancedSearchHighlighting is true (CVE-2017-0365). SVG filter evasion using default attribute values in DTD declaration (CVE-2017-0366). Escape content model/format url parameter in message (CVE-2017-0368). Sysops can undelete pages, although the page is protected against it (CVE-2017-0369). Spam blacklist ineffective on encoded URLs inside file inclusion syntax's link parameter (CVE-2017-0370).

CVSS metrics

Risk metrics not yet published.

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Mageia1 product
  • mediawiki< 1.23.16-1.mga5

1 vendor · 1 product

References

3 links