CVE-2015-8001
Vulnerability from cvelistv5
Published
2015-11-09 18:00
Modified
2024-08-06 08:06
Severity ?
Summary
The chunked upload API (ApiUpload) in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not restrict the uploaded data to the claimed file size, which allows remote authenticated users to cause a denial of service via a chunk that exceeds the file size.
References
cve@mitre.orghttp://www.securitytracker.com/id/1034028
cve@mitre.orghttps://lists.wikimedia.org/pipermail/mediawiki-announce/2015-October/000181.htmlPatch, Vendor Advisory
cve@mitre.orghttps://phabricator.wikimedia.org/T91203Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1034028
af854a3a-2127-422b-91ae-364da2661108https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-October/000181.htmlPatch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://phabricator.wikimedia.org/T91203Vendor Advisory
Impacted products
Vendor Product Version
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T08:06:31.520Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "1034028",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1034028"
          },
          {
            "name": "[MediaWiki-announce] 20151016 Security Release: 1.25.3, 1.24.4 and 1.23.11",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-October/000181.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://phabricator.wikimedia.org/T91203"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-10-16T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The chunked upload API (ApiUpload) in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not restrict the uploaded data to the claimed file size, which allows remote authenticated users to cause a denial of service via a chunk that exceeds the file size."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2015-11-09T17:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "1034028",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1034028"
        },
        {
          "name": "[MediaWiki-announce] 20151016 Security Release: 1.25.3, 1.24.4 and 1.23.11",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-October/000181.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://phabricator.wikimedia.org/T91203"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2015-8001",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The chunked upload API (ApiUpload) in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not restrict the uploaded data to the claimed file size, which allows remote authenticated users to cause a denial of service via a chunk that exceeds the file size."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "1034028",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1034028"
            },
            {
              "name": "[MediaWiki-announce] 20151016 Security Release: 1.25.3, 1.24.4 and 1.23.11",
              "refsource": "MLIST",
              "url": "https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-October/000181.html"
            },
            {
              "name": "https://phabricator.wikimedia.org/T91203",
              "refsource": "CONFIRM",
              "url": "https://phabricator.wikimedia.org/T91203"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2015-8001",
    "datePublished": "2015-11-09T18:00:00",
    "dateReserved": "2015-10-28T00:00:00",
    "dateUpdated": "2024-08-06T08:06:31.520Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2015-8001\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2015-11-09T18:59:00.113\",\"lastModified\":\"2024-11-21T02:37:49.343\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The chunked upload API (ApiUpload) in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not restrict the uploaded data to the claimed file size, which allows remote authenticated users to cause a denial of service via a chunk that exceeds the file size.\"},{\"lang\":\"es\",\"value\":\"La API chunked upload (ApiUpload) en MediaWiki en versiones anteriores a 1.23.11, 1.24.x en versiones anteriores a 1.24.4 y 1.25.x en versiones anteriores a 1.25.3 no restringe los datos subidos al tama\u00f1o de archivo declarado, lo que permite a usuarios remotos autenticados causar una denegaci\u00f3n de servicio a trav\u00e9s de un fragmento que excede del tama\u00f1o de archivo.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:S/C:N/I:N/A:P\",\"baseScore\":3.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":6.8,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-284\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"1.23.10\",\"matchCriteriaId\":\"FE35D692-87E9-4982-AA23-27EBD5E5EEE1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mediawiki:mediawiki:1.24.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0B21EB21-AE87-48BF-B4A1-5E63A2E116B4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mediawiki:mediawiki:1.24.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A6C00423-B3FE-485A-9014-22F409DBD377\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mediawiki:mediawiki:1.24.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E90C95FB-71CA-4CA1-935D-58A08244A81F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mediawiki:mediawiki:1.24.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5DDBD41F-C2D5-4D7C-B069-FBC2C8EBB81C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mediawiki:mediawiki:1.25.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9129F374-93CB-43CE-A3B2-DB6483514F32\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mediawiki:mediawiki:1.25.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CE125142-10A2-4ACF-9BA4-44E63C1E5DB6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mediawiki:mediawiki:1.25.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DF21D6EE-CEAC-42A7-99B6-D9D033E1FEC6\"}]}]}],\"references\":[{\"url\":\"http://www.securitytracker.com/id/1034028\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-October/000181.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://phabricator.wikimedia.org/T91203\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.securitytracker.com/id/1034028\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-October/000181.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://phabricator.wikimedia.org/T91203\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.