VDB
Sign up
MEDIUM

GHSA-xpv7-93cm-4mxv

img_auth.php may leak private extension images into the public cache

Quick fix

GHSA-xpv7-93cm-4mxv — mediawiki/core: upgrade to the fixed version with the command below.

composer require mediawiki/core:^1.31.8

Details

In MediaWiki before 1.31.8, 1.32.x and 1.33.x before 1.33.4, and 1.34.x before 1.34.2, private wikis behind a caching server using the img_auth.php image authorization security feature may have had their files cached publicly, so any unauthorized user could view them. This occurs because Cache-Control and Vary headers were mishandled.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/mediawiki/core
Introduced in: 0Fixed in: 1.31.8
Fixcomposer require mediawiki/core:^1.31.8
Packagist/mediawiki/core
Introduced in: 1.32.0Fixed in: 1.33.4
Fixcomposer require mediawiki/core:^1.33.4
Packagist/mediawiki/core
Introduced in: 1.34.0Fixed in: 1.34.2
Fixcomposer require mediawiki/core:^1.34.2

References