Skip to content
OpenAdvisories
Medium CVE-2020-15005 BIT-mediawiki-2020-15005EUVD-2022-5838GHSA-xpv7-93cm-4mxv

img_auth.php may leak private extension images into the public cache

Published Jun 24, 2020 · Updated Aug 4, 2024 · Assigned by mitre

Package: mediawiki Package: mediawiki Package: mediawiki/core Ecosystem: Debian Ecosystem: Packagist Ecosystem: Ubuntu

Description

In MediaWiki before 1.31.8, 1.32.x and 1.33.x before 1.33.4, and 1.34.x before 1.34.2, private wikis behind a caching server using the img_auth.php image authorization security feature may have had their files cached publicly, so any unauthorized user could view them. This occurs because Cache-Control and Vary headers were mishandled.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 mediawiki 1:1.31.8-1 —
Debian 13 mediawiki 1:1.31.8-1 —
Debian 12 mediawiki 1:1.31.8-1 —
Debian 10 mediawiki 1:1.31.10-1~deb10u1 DSA-4767-1
Debian 9 mediawiki 1:1.27.7-1~deb9u7 DLA-2504-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS mediawiki No fix yet —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS mediawiki No fix yet —

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist mediawiki/core < 1.31.8 1.31.8 GHSA-xpv7-93cm-4mxv
Packagist mediawiki/core >= 1.32.0, < 1.33.4 1.33.4 GHSA-xpv7-93cm-4mxv
Packagist mediawiki/core >= 1.34.0, < 1.34.2 1.34.2 GHSA-xpv7-93cm-4mxv

Advisories 2

References