Описание
The chunked upload API (ApiUpload) in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not restrict the uploaded data to the claimed file size, which allows remote authenticated users to cause a denial of service via a chunk that exceeds the file size.
| Релиз | Статус | Примечание |
|---|---|---|
| artful | ignored | end of life |
| bionic | not-affected | 1:1.27.4-3 |
| cosmic | not-affected | 1:1.31.1-3 |
| devel | not-affected | 1:1.31.1-3 |
| disco | not-affected | 1:1.31.1-3 |
| esm-apps/bionic | not-affected | 1:1.27.4-3 |
| esm-infra-legacy/trusty | DNE | trusty/esm was DNE [trusty was needed] |
| precise | ignored | end of life |
| precise/esm | DNE | precise was needs-triage |
| trusty | ignored | end of standard support |
Показывать по
EPSS
3.5 Low
CVSS2
Связанные уязвимости
The chunked upload API (ApiUpload) in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not restrict the uploaded data to the claimed file size, which allows remote authenticated users to cause a denial of service via a chunk that exceeds the file size.
The chunked upload API (ApiUpload) in MediaWiki before 1.23.11, 1.24.x ...
The chunked upload API (ApiUpload) in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not restrict the uploaded data to the claimed file size, which allows remote authenticated users to cause a denial of service via a chunk that exceeds the file size.
EPSS
3.5 Low
CVSS2