CVE-2023-36674
Fixed in a distro release EPSS <1%
An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x before 1.39.4, and 1.40.x before 1.40.1. It is possible to bypass the Bad image list (aka badFile) by using the thumb parameter (aka Manualthumb) of the File syntax.
Products: mediawiki
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 11 | mediawiki | 1:1.35.11-1~deb11u1 |
| Debian 12 | mediawiki | 1:1.39.4-1~deb12u1 |
| Debian 13 | mediawiki | 1:1.39.4-1 |
| Debian 14 | mediawiki | 1:1.39.4-1 |
| Ubuntu 18.04 LTS | mediawiki | no fix |
| Ubuntu Pro 20.04 LTS | mediawiki | no fix |
| Ubuntu Pro 22.04 LTS | mediawiki | no fix |