CVE-2017-0370

Published: 13 April 2018

Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw were Spam blacklist is ineffective on encoded URLs inside file inclusion syntax's link parameter.

Priority

CVSS 3 base score: 5.3

Status

Package	Release	Status
mediawiki Launchpad, Ubuntu, Debian	Upstream	Released (1:1.27.2-1)



	Ubuntu 18.04 LTS (Bionic Beaver)	Not vulnerable (1:1.27.4-3)
	Ubuntu 16.04 LTS (Xenial Xerus)	Does not exist
	Ubuntu 14.04 ESM (Trusty Tahr)	Does not exist (trusty was needed)

References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0370
https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-April/000207.html
NVD
Launchpad
Debian

Bugs

https://phabricator.wikimedia.org/T48143

Join the discussion

Ubuntu security updates mailing list
Security announcements mailing list

Canonical is offering Extended Security Maintenance

Canonical is offering Ubuntu 14.04 Extended Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM