CVE-2016-6331 Missing authorization in n/a
Remote attackers can bypass per-title read restrictions in MediaWiki via the API parse action, exposing restricted content.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-6331?
CVE-2016-6331 is a high-severity missing authorization vulnerability in Mediawiki Mediawiki, published on 20 Apr 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ApiParse in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to bypass intended per-title read restrictions via a parse action to api.php.
Weakness: CWE-284
Which versions are affected by CVE-2016-6331?
It affects 1 product.
Products include Mediawiki Mediawiki.
How do I fix CVE-2016-6331?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2016-6331 being exploited?
There is no known exploitation of CVE-2016-6331 in the wild and no public exploit code.
Other vulnerabilities in Mediawiki Mediawiki
Sources
Also known as DEBIAN-CVE-2016-6331, GHSA-fp5m-f325-vm83.