Vulnerability Description
MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote authenticated users with undelete permissions to bypass intended suppressrevision and deleterevision restrictions and remove the revision deletion status of arbitrary file revisions by using Special:Undelete.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mediawiki | Mediawiki | <= 1.23.14 |
Related Weaknesses (CWE)
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1369613Issue Tracking
- https://lists.wikimedia.org/pipermail/mediawiki-announce/2016-August/000195.htmlMailing ListPatchVendor Advisory
- https://phabricator.wikimedia.org/T132926PatchThird Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1369613Issue Tracking
- https://lists.wikimedia.org/pipermail/mediawiki-announce/2016-August/000195.htmlMailing ListPatchVendor Advisory
- https://phabricator.wikimedia.org/T132926PatchThird Party Advisory
FAQ
What is CVE-2016-6336?
CVE-2016-6336 is a vulnerability with a CVSS score of 6.5 (MEDIUM). MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote authenticated users with undelete permissions to bypass intended suppressrevision and deleterevision restrictions...
How severe is CVE-2016-6336?
CVE-2016-6336 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2016-6336?
Check the references section above for vendor advisories and patch information. Affected products include: Mediawiki Mediawiki.