CVE-2017-8815
The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2...
The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attribute injection attacks via glossary rules.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attribute injection attacks via glossary rules.
- Record
CVE-2017-8815- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attribute injection attacks via glossary rules.
- Record
CVE-2017-8815- Updated
- 2026-11-02
EUVDEUVD-2017-17758 No score
The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attribute injection attacks via glossary rules.
- Record
EUVD-2017-17758- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pj3w-586q-8mgr
The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2...
The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attribute injection attacks via glossary rules.
- Record
GHSA-pj3w-586q-8mgr- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attribute injection attacks via glossary rules.
- Record
CVE-2017-8815- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-8815
The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attribute injection attacks via glossary rules.
- Record
DEBIAN-CVE-2017-8815- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVMGASA-2017-0429 No score
Updated mediawiki packages fix security vulnerabilities
XSS when $wgShowExceptionDetails = false and browser sends non-standard url escaping (CVE-2017-8808).
Reflected File Download from api.php (CVE-2017-8809).
On private wikis, login form shouldn't distinguish between login failure due to bad username and bad password (CVE-2017-8810).
It's possible to mangle HTML via raw message parameter expansion (CVE-2017-8811).
The id attribute on headlines allow raw > (CVE-2017-8812).
Language converter can be tricked into replacing text inside tags by adding a lot of junk after the rule definition (CVE-2017-8814).
Language converter: unsafe attribute injection via glossary rules (CVE-2017-8815).
composer.json has require-dev versions of PHPUnit with known security issues (CVE-2017-9841).
Note that MediaWiki 1.23.x on Mageia 5 is no longer supported. Those using the mediawiki package on Mageia 5 should upgrade to Mageia 6.
- Record
MGASA-2017-0429- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mediawikiDebian:12 |
before 1:1.27.4-1 | 1:1.27.4-1 |
mediawikiDebian:13 |
before 1:1.27.4-1 | 1:1.27.4-1 |
mediawikiDebian:14 |
before 1:1.27.4-1 | 1:1.27.4-1 |
mediawikiDebian:9 From an advisory covering 7 CVEs |
before 1:1.27.4-1~deb9u1, plus listed versions 1:1.27.3-11:1.27.4-1~bpo8+1 |
1:1.27.4-1~deb9u1 |
mediawikiMageia:6 From an advisory covering 8 CVEs |
before 1.27.4-1.mga6 | 1.27.4-1.mga6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-8815 is a high vulnerability (CVSS 7.5) in Mediawiki, published November 15, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.61%, the 76th percentile. Fixed in mediawiki 1:1.27.4-1.
References
securitytracker.com/id/1039812
lists.wikimedia.org/pipermail/mediawiki-announce/2017-November/000216.html
debian.org/security/2017/dsa-4036
nvd.nist.gov/vuln/detail/CVE-2017-8815
github.com/advisories/GHSA-pj3w-586q-8mgr
security-tracker.debian.org/tracker/CVE-2017-8815
advisories.mageia.org/MGASA-2017-0429.html
bugs.mageia.org/show_bug.cgi?id=22038