vendor:
MediaWiki
by:
Netanel Rubin, Brandon Perry, Ben Harris, Ben Campbell
7.5
CVSS
HIGH
Command Execution
Command Injection (not mentioned in the text)
CWE
Product Name: MediaWiki
Affected Version From: 1.19.x
Affected Version To: 1.22.x
Patch Exists: YES
Related CWE: CVE-2014-1610
CPE:
Platforms Tested:
2014
MediaWiki Thumb.php Remote Command Execution
MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5 and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows remote unauthenticated users to execute arbitrary commands via shell metacharacters. If no target file is specified this module will attempt to log in with the provided credentials to upload a file (.DjVu) to use for exploitation.
Mitigation:
Patch/update to version 1.22.2, 1.21.5 or 1.19.11 or disable DjVu and PDF file upload support.