CVE-2016-6331
UnknownEPSS 2.13%
Last modified
CVE-2016-6331 is a vulnerability of currently unknown severity. ApiParse in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to bypass intended per-title read restrictions via a parse action to api.php.. EPSS estimates a 2.13% chance of exploitation in the next 30 days.
Description
ApiParse in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to bypass intended per-title read restrictions via a parse action to api.php.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Mediawiki | Mediawiki | <= 1.23.14 |
| Mediawiki | Mediawiki | 1.26.0 |
| Mediawiki | Mediawiki | 1.26.1 |
| Mediawiki | Mediawiki | 1.26.2 |
| Mediawiki | Mediawiki | 1.26.3 |
| Mediawiki | Mediawiki | 1.26.4 |
| Mediawiki | Mediawiki | 1.27.0 |
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1369613Issue Tracking
- https://lists.wikimedia.org/pipermail/mediawiki-announce/2016-August/000195.htmlMailing List, Patch, Vendor Advisory
- https://phabricator.wikimedia.org/T115333Patch, Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1369613Issue Tracking
- https://lists.wikimedia.org/pipermail/mediawiki-announce/2016-August/000195.htmlMailing List, Patch, Vendor Advisory
- https://phabricator.wikimedia.org/T115333Patch, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2016-6331?
ApiParse in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to bypass intended per-title read restrictions via a parse action to api.php.
How severe is CVE-2016-6331?
Severity scoring for CVE-2016-6331 is pending analysis. The EPSS model estimates a 2.13% probability of exploitation in the next 30 days.
How do I fix CVE-2016-6331?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2016
- CVE-2016-6325The Tomcat package on Red Hat Enterprise Linux (RHEL) 5 thro…
- CVE-2016-6326Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2016-6327drivers/infiniband/ulp/srpt/ib_srpt.c in the Linux kernel be…
- CVE-2016-6328A vulnerability was found in libexif. An integer overflow wh…8.1
- CVE-2016-6329OpenVPN, when using a 64-bit block cipher, makes it easier f…
- CVE-2016-6330The server in Red Hat JBoss Operations Network (JON), when S…
- CVE-2016-6332MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x b…
- CVE-2016-6333Cross-site scripting (XSS) vulnerability in the CSS user sub…
- CVE-2016-6334Cross-site scripting (XSS) vulnerability in the Parser::repl…
- CVE-2016-6335MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x b…
- CVE-2016-6336MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x b…
- CVE-2016-6337MediaWiki 1.27.x before 1.27.1 might allow remote attackers …
Are you affected by CVE-2016-6331?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST