CVE-2017-0371
mediawiki: MediaWiki before 1.23.16, 1.24.x through 1.27.x before 1.27.2, and 1.28.x before 1.28.1 allows remote attackers to di...
CVE-2017-0371 is fixed in mediawiki on 1 platform, first by DEBIAN-CVE-2017-0371, released February 18, 2022. It is not reported as exploited. Patch Radar priority: High.
High
CVSS
7.5
high
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0157
75th percentile
MediaWiki before 1.23.16, 1.24.x through 1.27.x before 1.27.2, and 1.28.x before 1.28.1 allows remote attackers to discover the IP addresses of Wiki visitors via a style="background-image: attr(title url);" attack within a DIV element that has an attacker-controlled URL in the title attribute.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| mediawiki · Debian 12.15 (bookworm) | 1:1.27.2-1 | DEBIAN-CVE-2017-0371 | Feb 18, 2022 |
| mediawiki · Debian 13.5 (trixie) | 1:1.27.2-1 | DEBIAN-CVE-2017-0371 | Feb 18, 2022 |
| mediawiki · Debian 14 | 1:1.27.2-1 | DEBIAN-CVE-2017-0371 | Feb 18, 2022 |