Remote Code Execution Vulnerability in MediaWiki by Wikimedia
CVE-2017-8812
5.3MEDIUM
Key Information:
- Vendor
Mediawiki
- Vendor
- CVE Published:
- 15 November 2017
What is CVE-2017-8812?
A security flaw in MediaWiki versions prior to 1.27.4, as well as versions 1.28.x prior to 1.28.3 and 1.29.x before 1.29.2, enables remote attackers to exploit the id attribute of a headline, allowing for the injection of '>' characters. This can lead to unauthorized code execution, posing significant risks for affected installations. It is crucial for users to update to the latest versions to mitigate this vulnerability.
Affected Version(s)
MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2