CVE-2017-0366 SVG filter evasion using default attribute values in DTD declaration

Medium 5.4 Published 13 Apr 2018 Updated 16 Sep 2024

Attackers can bypass SVG filters in MediaWiki by exploiting default attribute values in DTD declarations, potentially allowing malicious content injection.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2017-0366?

CVE-2017-0366 is a medium-severity vulnerability in Debian Debian Linux, published on 13 Apr 2018. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw allowing to evade SVG filter using default attribute values in DTD declaration.

Weakness: CWE-20

Which versions are affected by CVE-2017-0366?

It affects 2 products.

Products include Debian Debian Linux, Mediawiki Mediawiki.

How do I fix CVE-2017-0366?

Upgrade to a fixed version.

Is CVE-2017-0366 being exploited?

There is no known exploitation of CVE-2017-0366 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2017-0366, GHSA-3cfx-qf53-8h6m.