CVE-2014-1610 in MediaWiki

Сводка (Английский)

MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5 and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the page parameter to includes/media/DjVu.php; (2) the w parameter (aka width field) to thumb.php, which is not properly handled by includes/media/PdfHandler_body.php; and possibly unspecified vectors in (3) includes/media/Bitmap.php and (4) includes/media/ImageHandler.php.

Резервировать

19.01.2014

Раскрытие

30.01.2014

Записи

VulDB provides additional information and datapoints for this CVE:

ИД	Уязвимость	CWE	Экс	Кон	CVE
12126	MediaWiki pdfhandler_body.php эскалация привилегий	20	Высокий	Официальное исправление	CVE-2014-1610
12125	MediaWiki thumb.php эскалация привилегий	20	Высокий	Официальное исправление	CVE-2014-1610