CVE-2016-6331
ApiParse in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows...
CVE-2016-6331 is a high vulnerability (CVSS 7.5) in Mediawiki, published September 16, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.13%, the 81st percentile. Fixed in mediawiki 1:1.27.1-1.
ApiParse in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to bypass intended per-title read restrictions via a parse action to api.php.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
ApiParse in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to bypass intended per-title read restrictions via a parse action to api.php.
- Record
CVE-2016-6331- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
CVE List No score
ApiParse in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to bypass intended per-title read restrictions via a parse action to api.php.
- Record
CVE-2016-6331- Updated
- 2026-11-02
EUVDEUVD-2016-7258 No score
ApiParse in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to bypass intended per-title read restrictions via a parse action to api.php.
- Record
EUVD-2016-7258- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fp5m-f325-vm83
ApiParse in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows...
ApiParse in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to bypass intended per-title read restrictions via a parse action to api.php.
- Record
GHSA-fp5m-f325-vm83- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
OSV
ApiParse in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to bypass intended per-title read restrictions via a parse action to api.php.
- Record
CVE-2016-6331- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-6331
ApiParse in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to bypass intended per-title read restrictions via a parse action to api.php.
- Record
DEBIAN-CVE-2016-6331- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVMGASA-2016-0305 No score
Updated mediawiki packages fix security vulnerability
Check read permission when loading page content in ApiParse (CVE-2016-6331)
Make blocks log users out if $wgBlockDisablesLogin is true (CVE-2016-6332)
Make $wgBlockDisablesLogin also restrict logged in permissions (CVE-2016-6332)
Require login to preview user CSS pages (CVE-2016-6333)
Escape '<' and ']]>' in inline <style> blocks (CVE-2016-6333)
XSS in unclosed internal links (CVE-2016-6334)
API: Generate head items in the context of the given title (CVE-2016-6335)
Do not allow undeleting a revision deleted file if it is the top file (CVE-2016-6336)
The mediawiki package has been updated to version 1.23.15, which contains the above fixes.
- Record
MGASA-2016-0305- Updated
- 2026-11-02
Affected products
Affected packages
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
lists.wikimedia.org/pipermail/mediawiki-announce/2016-August/000195.html
bugzilla.redhat.com/show_bug.cgi?id=1369613
phabricator.wikimedia.org/T115333
nvd.nist.gov/vuln/detail/CVE-2016-6331
github.com/advisories/GHSA-fp5m-f325-vm83
security-tracker.debian.org/tracker/CVE-2016-6331
advisories.mageia.org/MGASA-2016-0305.html
bugs.mageia.org/show_bug.cgi?id=19252