MEDIUM5.3
GHSA-2c28-7gwv-cpgf
Mediawiki tarball is missing .htaccess files
Quick fix
GHSA-2c28-7gwv-cpgf — mediawiki/core: upgrade to the fixed version with the command below.
composer require mediawiki/core:^1.31.1Details
Mediawiki 1.31 before 1.31.1 misses .htaccess files in the provided tarball used to protect some directories that shouldn't be web accessible.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist/mediawiki/core
Introduced in:
1.31.0Fixed in: 1.31.1Fix
composer require mediawiki/core:^1.31.1References
- https://nvd.nist.gov/vuln/detail/CVE-2018-13258[ADVISORY]
- https://github.com/FriendsOfPHP/security-advisories/blob/master/mediawiki/core/CVE-2018-13258.yaml[WEB]
- https://github.com/wikimedia/mediawiki[PACKAGE]
- https://lists.wikimedia.org/pipermail/wikitech-l/2018-September/090849.html[WEB]
- https://phabricator.wikimedia.org/T199029[WEB]
- http://www.securitytracker.com/id/1041695[WEB]