CVE-2014-1610 in MediaWiki

Resumen (Inglés)

MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5 and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the page parameter to includes/media/DjVu.php; (2) the w parameter (aka width field) to thumb.php, which is not properly handled by includes/media/PdfHandler_body.php; and possibly unspecified vectors in (3) includes/media/Bitmap.php and (4) includes/media/ImageHandler.php.

Reservar

2014-01-19

Divulgación

2014-01-30

Voces

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerabilidad	CWE	Exp	Con	CVE
12126	MediaWiki pdfhandler_body.php escalada de privilegios	20	Alto	Arreglo oficial	CVE-2014-1610
12125	MediaWiki thumb.php escalada de privilegios	20	Alto	Arreglo oficial	CVE-2014-1610