CVE-2011-4360

Published: Jan 8, 2012Modified: Apr 29, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

MediaWiki before 1.17.1 allows remote attackers to obtain the page titles of all restricted pages via a series of requests involving the (1) curid or (2) oldid parameter.

Affected (3)

Products: Mediawiki: Mediawiki · Debian: Debian Linux

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Mediawiki Mediawiki	Before 1.17.1

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 5.0
Debian Debian Linux	Version 6.0

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (12)

http://lists.wikimedia.org/pipermail/mediawiki-announce/2011-November/000104.html

Source: secalert@redhat.com

PatchVendor Advisory

http://openwall.com/lists/oss-security/2011/11/29/12

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://openwall.com/lists/oss-security/2011/11/29/6

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.debian.org/security/2011/dsa-2366

Source: secalert@redhat.com

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=758171

Source: secalert@redhat.com

Issue TrackingThird Party Advisory

https://bugzilla.wikimedia.org/show_bug.cgi?id=32276

Source: secalert@redhat.com

Issue TrackingPatchVendor Advisory

http://lists.wikimedia.org/pipermail/mediawiki-announce/2011-November/000104.html