CVE Vulnerabilities

CVE-2017-0372

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Published: Apr 13, 2018 | Modified: May 17, 2018
CVSS 3.x
9.8
CRITICAL
Source:
NVD
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
7.5 HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P
RedHat/V2
RedHat/V3
Ubuntu
MEDIUM

Parameters injection in the SyntaxHighlight extension of Mediawiki before 1.23.16, 1.27.3 and 1.28.2 might result in multiple vulnerabilities.

Weakness

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Affected Software

Name Vendor Start Version End Version
Mediawiki Mediawiki * 1.23.15 (including)
Mediawiki Mediawiki 1.27.0 (including) 1.27.0 (including)
Mediawiki Mediawiki 1.27.1 (including) 1.27.1 (including)
Mediawiki Mediawiki 1.27.2 (including) 1.27.2 (including)
Mediawiki Mediawiki 1.28.0 (including) 1.28.0 (including)
Mediawiki Mediawiki 1.28.1 (including) 1.28.1 (including)
Mediawiki Ubuntu artful *
Mediawiki Ubuntu precise *
Mediawiki Ubuntu trusty *
Mediawiki Ubuntu upstream *
Mediawiki Ubuntu yakkety *
Mediawiki Ubuntu zesty *

Potential Mitigations

References