CVE-2023-36674
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
An issue was discovered in MediaWiki before version 1.35.11 and in versions 1.36.x through 1.38.x before 1.38.7, 1.39.x before 1.39.4, and 1.40.x before 1.40.1 that allows bypassing the Bad image list (badFile) using the thumb parameter (Manualthumb) of the File syntax.
Risk Assessment
Organizations may be exposed to the introduction of unwanted or malicious images into the system, potentially leading to security breaches and reputational damage.
Recommendation
It is recommended to update MediaWiki to the latest version to mitigate this vulnerability and to monitor the usage of image-related parameters.
Original NVD description (English source)
An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x before 1.39.4, and 1.40.x before 1.40.1. It is possible to bypass the Bad image list (aka badFile) by using the thumb parameter (aka Manualthumb) of the File syntax.