CVE-2015-8005

MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 uses the thumbnail ImageMagick command line argument, which allows remote attackers to obtain the installation path by reading the metadata of a PNG thumbnail file.

Score

CVSS 2.0 5.0 Medium

Status

Modified - cve@mitre.org

Published

2015-11-09

Last modified

2024-08-06

Weaknesses

CWE-200

Affected products

• Mediawiki (Mediawiki)

References

• http://www.securitytracker.com/id/1034028
• https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-October/000181.html
• https://phabricator.wikimedia.org/T108616