CVE-2020-15005
img_auth.php may leak private extension images into the public cache
In MediaWiki before 1.31.8, 1.32.x and 1.33.x before 1.33.4, and 1.34.x before 1.34.2, private wikis behind a caching server using the img_auth.php image authorization security feature may have had their files cached publicly, so any unauthorized user could view them. This occurs because Cache-Control and Vary headers were mishandled.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
In MediaWiki before 1.31.8, 1.32.x and 1.33.x before 1.33.4, and 1.34.x before 1.34.2, private wikis behind a caching server using the img_auth.php image authorization security feature may have had their files cached publicly, so any unauthorized user could view them. This occurs because Cache-Control and Vary headers were mishandled.
- Record
CVE-2020-15005- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N - CVSS 2.0
- 2.6 Low
AV:N/AC:H/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
CVE List No score
In MediaWiki before 1.31.8, 1.32.x and 1.33.x before 1.33.4, and 1.34.x before 1.34.2, private wikis behind a caching server using the img_auth.php image authorization security feature may have had their files cached publicly, so any unauthorized user could view them. This occurs because Cache-Control and Vary headers were mishandled.
- Record
CVE-2020-15005- Updated
- 2026-11-02
EUVDEUVD-2022-5838 No score
In MediaWiki before 1.31.8, 1.32.x and 1.33.x before 1.33.4, and 1.34.x before 1.34.2, private wikis behind a caching server using the img_auth.php image authorization security feature may have had their files cached publicly, so any unauthorized user could view them. This occurs because Cache-Control and Vary headers were mishandled.
- Record
EUVD-2022-5838- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xpv7-93cm-4mxv No score
img_auth.php may leak private extension images into the public cache
In MediaWiki before 1.31.8, 1.32.x and 1.33.x before 1.33.4, and 1.34.x before 1.34.2, private wikis behind a caching server using the img_auth.php image authorization security feature may have had their files cached publicly, so any unauthorized user could view them. This occurs because Cache-Control and Vary headers were mishandled.
- Record
GHSA-xpv7-93cm-4mxv- Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
In MediaWiki before 1.31.8, 1.32.x and 1.33.x before 1.33.4, and 1.34.x before 1.34.2, private wikis behind a caching server using the img_auth.php image authorization security feature may have had their files cached publicly, so any unauthorized user could view them. This occurs because Cache-Control and Vary headers were mishandled.
- Record
CVE-2020-15005- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-15005
In MediaWiki before 1.31.8, 1.32.x and 1.33.x before 1.33.4, and 1.34.x before 1.34.2, private wikis behind a caching server using the img_auth.php image authorization security feature may have had their files cached publicly, so any unauthorized user could view them. This occurs because Cache-Control and Vary headers were mishandled.
- Record
DEBIAN-CVE-2020-15005- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2020-15005
In MediaWiki before 1.31.8, 1.32.x and 1.33.x before 1.33.4, and 1.34.x before 1.34.2, private wikis behind a caching server using the img_auth.php image authorization security feature may have had their files cached publicly, so any unauthorized user could view them. This occurs because Cache-Control and Vary headers were mishandled.
- Record
UBUNTU-CVE-2020-15005- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVBIT-mediawiki-2020-15005 No score
In MediaWiki before 1.31.8, 1.32.x and 1.33.x before 1.33.4, and 1.34.x before 1.34.2, private wikis behind a caching server using the img_auth.php image authorization security feature may have had their files cached publicly, so any unauthorized user could view them. This occurs because Cache-Control and Vary headers were mishandled.
- Record
BIT-mediawiki-2020-15005- Updated
- 2026-11-02
OSVGHSA-xpv7-93cm-4mxv No score
img_auth.php may leak private extension images into the public cache
In MediaWiki before 1.31.8, 1.32.x and 1.33.x before 1.33.4, and 1.34.x before 1.34.2, private wikis behind a caching server using the img_auth.php image authorization security feature may have had their files cached publicly, so any unauthorized user could view them. This occurs because Cache-Control and Vary headers were mishandled.
- Record
GHSA-xpv7-93cm-4mxv- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVMGASA-2020-0292 No score
Updated mediawiki packages fix security vulnerability
Updated mediawiki packages fix security vulnerability:
In MediaWiki before 1.31.8, private wikis behind a caching server using the img_auth.php image authorization security feature may have had their files cached publicly, so any unauthorized user could view them. This occurs because Cache-Control and Vary headers were mishandled (CVE-2020-15005).
- Record
MGASA-2020-0292- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mediawiki/corePackagist |
before 1.31.8 | 1.31.8 |
mediawiki/corePackagist |
1.32.0 up to 1.33.4 | 1.33.4 |
mediawiki/corePackagist |
1.34.0 up to 1.34.2 | 1.34.2 |
mediawikiBitnami |
before 1.31.8, 1.32.0 up to 1.33.4, 1.34.0 up to 1.34.2 | 1.31.81.33.41.34.2 |
mediawikiDebian:12 |
before 1:1.31.8-1 | 1:1.31.8-1 |
mediawikiDebian:13 |
before 1:1.31.8-1 | 1:1.31.8-1 |
mediawikiDebian:14 |
before 1:1.31.8-1 | 1:1.31.8-1 |
mediawikiDebian:9 From an advisory covering 4 CVEs |
before 1:1.27.7-1~deb9u7, plus listed versions 1:1.27.3-11:1.27.4-11:1.27.4-1~bpo8+11:1.27.4-1~deb9u11:1.27.4-2 Show 9 moreShow less1:1.27.4-31:1.27.5-1~deb9u11:1.27.6-1~deb9u11:1.27.7-1~deb9u11:1.27.7-1~deb9u21:1.27.7-1~deb9u31:1.27.7-1~deb9u41:1.27.7-1~deb9u51:1.27.7-1~deb9u6 |
1:1.27.7-1~deb9u7 |
mediawikiDebian:10 From an advisory covering 8 CVEs |
before 1:1.31.10-1~deb10u1, plus listed versions 1:1.31.2-11:1.31.4-11:1.31.4-1~deb10u11:1.31.5-11:1.31.5-2 Show 6 moreShow less1:1.31.5-31:1.31.6-11:1.31.6-1~deb10u11:1.31.7-11:1.31.7-1~deb10u11:1.31.8-1 |
1:1.31.10-1~deb10u1 |
mediawiki/corePackagist |
before 1.31.8, plus listed versions 1.20.31.20.41.20.51.20.61.20.7 Show 45 moreShow less1.20.81.21.01.21.11.21.101.21.111.21.21.21.31.21.41.21.51.21.61.21.71.21.81.21.91.22.0rc01.24.01.24.0-rc.01.24.0-rc.11.24.0-rc.21.24.0-rc.31.24.11.24.21.24.31.24.41.24.51.24.61.25.01.25.0-rc.01.25.11.25.21.25.31.25.41.25.51.25.61.26.01.26.11.26.21.26.31.26.41.27.01.27.0-rc.01.27.0-rc.11.27.11.27.21.27.31.27.4 |
1.31.8 |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
mediawiki/corePackagist |
1.32.0 up to 1.33.4, plus listed versions 1.32.11.32.21.32.31.32.41.32.5 Show 6 moreShow less1.32.61.33.01.33.0-rc.01.33.11.33.21.33.3 |
1.33.4 |
mediawiki/corePackagist |
1.34.0 up to 1.34.2, plus listed versions 1.34.1 |
1.34.2 |
mediawikiMageia:7 |
before 1.31.8-1.mga7 | 1.31.8-1.mga7 |
mediawikiUbuntu:18.04:LTS |
All versions, plus listed versions 1:1.27.3-11:1.27.4-11:1.27.4-21:1.27.4-3 |
None known |
mediawikiUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1:1.31.2-1ubuntu11:1.31.5-11:1.31.5-1ubuntu11:1.31.5-21:1.31.5-3 Show 4 moreShow less1:1.31.5-3ubuntu11:1.31.6-11:1.31.7-11:1.31.7-1ubuntu0.1~esm1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-15005 is a low vulnerability (CVSS 3.1) in Mediawiki, published June 24, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.30%, the 70th percentile. Fixed in mediawiki/core 1.31.8.
References
phabricator.wikimedia.org/T248947
gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/core/+/REL1_34/RELEASE-NOTES-1.34
lists.wikimedia.org/pipermail/wikitech-l/2020-June/093535.html
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EEZIMLJMJS72SJXPYL736XMUAVCRQD2H
Show 12 moreShow less
debian.org/security/2020/dsa-4767
lists.debian.org/debian-lts-announce/2020/12/msg00034.html
nvd.nist.gov/vuln/detail/CVE-2020-15005
github.com/advisories/GHSA-xpv7-93cm-4mxv
security-tracker.debian.org/tracker/CVE-2020-15005
advisories.mageia.org/MGASA-2020-0292.html
bugs.mageia.org/show_bug.cgi?id=26921
ubuntu.com/security/CVE-2020-15005
cve.org/CVERecord?id=CVE-2020-15005
Left out here: 30 versions. The JSON record has them.