CVE-2016-6336 Information

Description

MediaWiki before 1.23.15 1.26.x before 1.26.4 and 1.27.x before 1.27.1 allows remote authenticated users with undelete permissions to bypass intended suppressrevision and deleterevision restrictions and remove the revision deletion status of arbitrary file revisions by using Special:Undelete.

CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Reference

https://bugzilla.redhat.com/show_bug.cgi?id=1369613 https://lists.wikimedia.org/pipermail/mediawiki-announce/2016-August/000195.html https://phabricator.wikimedia.org/T132926

Attack Complexity

LOW

Privileges Required

LOW

User Interaction Required

LOW

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

NONE

Availability Impact

HIGH

Base Score

NONE

Base Severity

6.5