CVE-2017-0372 Information

Description

Parameters injection in the SyntaxHighlight extension of Mediawiki before 1.23.16 1.27.3 and 1.28.2 might result in multiple vulnerabilities.

CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Reference

https://bugs.debian.org/861585 https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-April/000207.html https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-April/000209.html https://phabricator.wikimedia.org/T158689 https://security-tracker.debian.org/tracker/CVE-2017-0372

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

HIGH

Base Severity

9.8