CVE-2015-8627

MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly normalize IP addresses containing zero-padded octets, which might allow remote attackers to bypass intended access restrictions by using an IP address that was not supposed to have been allowed.

Score

CVSS 3.0 5.3 Medium

Status

Modified - cve@mitre.org

Published

2017-03-23

Last modified

2024-08-06

Weaknesses

CWE-284

Affected products

• Mediawiki (Mediawiki)

References

• http://www.openwall.com/lists/oss-security/2015/12/21/8
• http://www.openwall.com/lists/oss-security/2015/12/23/7
• https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-December/000186.html
• https://phabricator.wikimedia.org/T97897