MediaWiki before 1.23.16, 1.24.x through 1.27.x before 1.27.2, and 1.28.x before 1.28.1 allows remote attackers to discover the IP addresses of Wiki visitors via a style=background-image: attr(title url); attack within a DIV element that has an attacker-controlled URL in the title attribute.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Mediawiki | Mediawiki | * | 1.23.16 (excluding) |
| Mediawiki | Mediawiki | 1.24.0 (including) | 1.27.2 (excluding) |
| Mediawiki | Mediawiki | 1.28.0 (including) | 1.28.1 (excluding) |