Vulnerability Description
MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 uses the thumbnail ImageMagick command line argument, which allows remote attackers to obtain the installation path by reading the metadata of a PNG thumbnail file.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mediawiki | Mediawiki | <= 1.23.10 |
Related Weaknesses (CWE)
References
- http://www.securitytracker.com/id/1034028
- https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-October/000181.htmPatchVendor Advisory
- https://phabricator.wikimedia.org/T108616Vendor Advisory
- http://www.securitytracker.com/id/1034028
- https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-October/000181.htmPatchVendor Advisory
- https://phabricator.wikimedia.org/T108616Vendor Advisory
FAQ
What is CVE-2015-8005?
CVE-2015-8005 is a vulnerability with a CVSS score of 5.0 (MEDIUM). MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 uses the thumbnail ImageMagick command line argument, which allows remote attackers to obtain the installation path by reading ...
How severe is CVE-2015-8005?
CVE-2015-8005 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2015-8005?
Check the references section above for vendor advisories and patch information. Affected products include: Mediawiki Mediawiki.