CVE Vulnerabilities

CVE-2018-0503

Improper Privilege Management

Published: Oct 04, 2018 | Modified: Nov 21, 2024
CVSS 3.x
4.3
MEDIUM
Source:
NVD
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS 2.x
4 MEDIUM
AV:N/AC:L/Au:S/C:N/I:P/A:N
RedHat/V2
RedHat/V3
5.3 LOW
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Ubuntu
MEDIUM

Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains a flaw where contrary to the documentation, $wgRateLimits entry for user overrides that for newbie.

Weakness

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Affected Software

Name Vendor Start Version End Version
Mediawiki Mediawiki 1.31.0 (including) 1.31.1 (excluding)
Mediawiki Mediawiki 1.27.5 (including) 1.27.5 (including)
Mediawiki Mediawiki 1.29.3 (including) 1.29.3 (including)
Mediawiki Mediawiki 1.30.1 (including) 1.30.1 (including)
Red Hat OpenShift Container Platform 3.10 RedHat mediawiki-0:1.27.7-1.el7 *
Red Hat OpenShift Container Platform 3.11 RedHat mediawiki-0:1.27.7-1.el7 *
Red Hat OpenShift Container Platform 3.9 RedHat mediawiki123-0:1.23.17-1.el7 *
Mediawiki Ubuntu bionic *
Mediawiki Ubuntu esm-apps/bionic *
Mediawiki Ubuntu trusty *
Mediawiki Ubuntu upstream *

Potential Mitigations

References