CVE-2018-0503

EPSS 0.38%
Veröffentlicht 04.10.2018 20:29:00
Zuletzt bearbeitet 21.11.2024 03:38:22
Quelle security@debian.org
CVE-Watchlists
Login
Unerledigt
Login

Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains a flaw where contrary to the documentation, $wgRateLimits entry for 'user' overrides that for 'newbie'.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 10

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Mediawiki ≫ Mediawiki Version >= 1.31.0 < 1.31.1

Mediawiki ≫ Mediawiki Version1.27.5

Mediawiki ≫ Mediawiki Version1.29.3

Mediawiki ≫ Mediawiki Version1.30.1

Debian ≫ Debian Linux Version9.0

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.38%	0.589

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	4.3	2.8	1.4	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
nvd@nist.gov	4	8	2.9	AV:N/AC:L/Au:S/C:N/I:P/A:N

CWE-269 Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

http://www.securitytracker.com/id/1041695

Third Party Advisory

VDB Entry

https://access.redhat.com/errata/RHSA-2019:3142

https://access.redhat.com/errata/RHSA-2019:3238

https://access.redhat.com/errata/RHSA-2019:3813

https://lists.wikimedia.org/pipermail/wikitech-l/2018-September/090849.html

Patch

Vendor Advisory

https://phabricator.wikimedia.org/T169545

Patch

Third Party Advisory

https://www.debian.org/security/2018/dsa-4301

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2018-0503

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2018-0503

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2018-0503

EUVD