The chunked upload API (ApiUpload) in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 allows remote authenticated users to cause a denial of service (disk consumption) via a file upload using one byte chunks.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Mediawiki | Mediawiki | * | 1.23.10 (including) |
| Mediawiki | Mediawiki | 1.24.0 (including) | 1.24.0 (including) |
| Mediawiki | Mediawiki | 1.24.1 (including) | 1.24.1 (including) |
| Mediawiki | Mediawiki | 1.24.2 (including) | 1.24.2 (including) |
| Mediawiki | Mediawiki | 1.24.3 (including) | 1.24.3 (including) |
| Mediawiki | Mediawiki | 1.25.0 (including) | 1.25.0 (including) |
| Mediawiki | Mediawiki | 1.25.1 (including) | 1.25.1 (including) |
| Mediawiki | Mediawiki | 1.25.2 (including) | 1.25.2 (including) |
| Mediawiki | Ubuntu | artful | * |
| Mediawiki | Ubuntu | precise | * |
| Mediawiki | Ubuntu | trusty | * |
| Mediawiki | Ubuntu | upstream | * |
| Mediawiki | Ubuntu | vivid | * |
| Mediawiki | Ubuntu | wily | * |
| Mediawiki | Ubuntu | yakkety | * |
| Mediawiki | Ubuntu | zesty | * |