Unrated
An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. When installing with a pre-existing...
CVE-2022-47927
First seen on SecPulse
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2022-47927 mediawiki Fixed in: 1:1.35.11-1~deb11u1
- Ubuntu UBUNTU-CVE-2022-47927 mediawiki
Original description The description as published by the source.
An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. When installing with a pre-existing data directory that has weak permissions, the SQLite files are created with file mode 0644, i.e., world readable to local users. These files include credentials data.
References
- advisory github.com
- advisory lists.fedoraproject.org
- advisory nvd.nist.gov
- advisory security.gentoo.org
- web lists.wikimedia.org
- web phabricator.wikimedia.org
- web lists.debian.org