Red Hat Security Advisory

RHSA-2019:3238

OpenShift Container Platform 3.10 mediawiki security update

Released 2019-10-29 · Red Hat rating Low · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 3.10 mediawiki-1.27.7-1.el7, mediawiki-doc-1.27.7-1.el7

Fixes 3 records

TI-2018-00461 CVE-2018-0504 · GHSA-hr8v-f4g2-p66f

Information disclosure in Special:Redirect/logid

LOW 34

Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains an information disclosure flaw in the Special:Redirect/logid

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.02875 Published 2018-10-04 Partial fix · 1.27.5, 1.29.3 +2 CWE-532

TI-2018-00462 CVE-2018-0505 · GHSA-5c6w-f4w2-2grp

BotPasswords can bypass CentralAuth's account lock

LOW 33

Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains a flaw where BotPasswords can bypass CentralAuth's account lock

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0197 Published 2018-10-04 Partial fix · 1.27.5, 1.29.3 +2 CWE-287

TI-2018-00460 CVE-2018-0503 · GHSA-mhfv-9h99-jwg7

$wgRateLimits entry for 'user' overrides 'newbie'

LOW 23

Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains a flaw where contrary to the documentation, $wgRateLimits entry for 'user' overrides that for 'newbie'.

CVSS 3.0MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0156 Published 2018-10-04 Partial fix · 1.27.5, 1.29.3 +2 CWE-269