Non évaluée
The FileImporter extension in MediaWiki through 1.35.0 was not properly attributing various user actions to a specific user's IP address. Instead, for...
CVE-2020-27621
Première détection SecPulse
Description d'origine La description telle que publiée par la source (souvent en anglais).
The FileImporter extension in MediaWiki through 1.35.0 was not properly attributing various user actions to a specific user's IP address. Instead, for various actions, it would report the IP address of an internal Wikimedia Foundation server by omitting X-Forwarded-For data. This resulted in an inability to properly audit and attribute various user actions performed via the FileImporter extension.
Références
- patch gerrit.wikimedia.org
- patch phabricator.wikimedia.org