{"id":"CVE-2015-8002","aliases":["DEBIAN-CVE-2015-8002","EUVD-2015-7898","GHSA-pgp4-g94c-393r","MGASA-2015-0421","UBUNTU-CVE-2015-8002"],"status":"published","title":"The chunked upload API (ApiUpload) in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x...","description":"The chunked upload API (ApiUpload) in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 allows remote authenticated users to cause a denial of service (disk consumption) via a file upload using one byte chunks.","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:L/Au:S/C:N/I:N/A:C","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01515,"percentile":0.74703,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-399"],"published":"2015-11-02T20:21:29Z","modified":"2026-09-09T06:47:26Z","fixes":[{"ecosystem":"Debian:12","package":"mediawiki","fixed_in":["1:1.25.5-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"mediawiki","fixed_in":["1:1.25.5-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mediawiki","fixed_in":["1:1.25.5-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.25.5-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.25.5-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.25.5-1"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.11-1.mga5"}]}],"bundled":5}],"products":[{"vendor":"mediawiki","product":"mediawiki"}],"references":[{"url":"https://phabricator.wikimedia.org/T91205","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","report"]},{"url":"http://www.securitytracker.com/id/1034028","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-October/000181.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Patch","Vendor Advisory","advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8002"},{"url":"https://github.com/advisories/GHSA-pgp4-g94c-393r"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-8002","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0421.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=16990","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2015/10/29/14","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-8002","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-8002","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-8002","description":"The chunked upload API (ApiUpload) in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 allows remote authenticated users to cause a denial of service (disk consumption) via a file upload using one byte chunks.","status":"published","published":"2015-11-09T18:00:00Z","modified":"2024-08-06T08:06:31.576Z","updated_at":"2026-11-02T14:35:40.900357Z"}],"euvd":[{"id":"EUVD-2015-7898","description":"The chunked upload API (ApiUpload) in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 allows remote authenticated users to cause a denial of service (disk consumption) via a file upload using one byte chunks.","status":"published","published":"2015-11-09T18:00:00Z","modified":"2024-08-06T08:06:31Z","updated_at":"2026-11-03T02:21:50.339607Z"}],"ghsa":[{"id":"GHSA-pgp4-g94c-393r","title":"The chunked upload API (ApiUpload) in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x...","description":"The chunked upload API (ApiUpload) in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 allows remote authenticated users to cause a denial of service (disk consumption) via a file upload using one byte chunks.","status":"published","published":"2022-05-17T04:02:39Z","modified":"2023-01-28T05:01:00Z","updated_at":"2026-11-02T14:43:27.435054Z"}],"nvd":[{"id":"CVE-2015-8002","description":"The chunked upload API (ApiUpload) in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 allows remote authenticated users to cause a denial of service (disk consumption) via a file upload using one byte chunks.","status":"published","published":"2015-11-09T18:59:01.693Z","modified":"2026-06-17T00:33:50.463Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:L/Au:S/C:N/I:N/A:C","level":"medium","assessor":"primary"}],"cwes":["CWE-399"],"updated_at":"2026-11-02T14:03:12.30866Z"}],"osv":[{"id":"CVE-2015-8002","description":"The chunked upload API (ApiUpload) in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 allows remote authenticated users to cause a denial of service (disk consumption) via a file upload using one byte chunks.","status":"published","published":"2015-11-09T18:59:01Z","modified":"2026-04-16T06:26:14.744456905Z","updated_at":"2026-11-02T15:44:01.068991Z"},{"id":"DEBIAN-CVE-2015-8002","description":"The chunked upload API (ApiUpload) in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 allows remote authenticated users to cause a denial of service (disk consumption) via a file upload using one byte chunks.","status":"published","published":"2015-11-09T18:59:01.693Z","modified":"2026-09-09T06:47:26.74139642Z","updated_at":"2026-11-02T15:45:27.04239Z"},{"id":"MGASA-2015-0421","title":"Updated mediawiki packages fix security vulnerabilities","description":"Updated mediawiki packages fix security vulnerabilities:\n\nIn MediaWiki before 1.23.11, the API failed to correctly stop adding new\nchunks to the upload when the reported size was exceeded, allowing a\nmalicious user to upload add an infinite number of chunks for a single file\nupload (CVE-2015-8001).\n\nIn MediaWiki before 1.23.11, a malicious user could upload chunks of 1 byte\nfor very large files, potentially creating a very large number of files on\nthe server's filesystem (CVE-2015-8002).\n\nIn MediaWiki before 1.23.11, it is not possible to throttle file uploads,\nor in other words, rate limit them (CVE-2015-8003).\n\nIn MediaWiki before 1.23.11, a missing authorization check when removing\nsuppression from a revision allowed users with the 'viewsuppressed' user\nright but not the appropriate 'suppressrevision' user right to unsuppress\nrevisions (CVE-2015-8004).\n\nIn MediaWiki before 1.23.11, thumbnails of PNG files generated with\nImageMagick contained the local file path in the image (CVE-2015-8005).\n","status":"published","published":"2015-11-02T20:21:29Z","modified":"2026-04-16T06:26:14.079020702Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"UBUNTU-CVE-2015-8002","description":"The chunked upload API (ApiUpload) in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 allows remote authenticated users to cause a denial of service (disk consumption) via a file upload using one byte chunks.","status":"withdrawn","published":"2015-11-09T18:59:00Z","modified":"2025-07-16T08:11:45.279639Z","updated_at":"2026-11-02T15:54:10.737723Z"}]}}