{"id":"CVE-2015-8004","aliases":["DEBIAN-CVE-2015-8004","EUVD-2015-7900","GHSA-xg2h-3f4g-42hc","MGASA-2015-0421","UBUNTU-CVE-2015-8004"],"status":"published","title":"MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not properly...","description":"MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not properly restrict access to revisions, which allows remote authenticated users with the viewsuppressed user right to remove revision suppressions via a crafted revisiondelete action, which returns a valid a change form.","severity":{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.01721,"percentile":0.77813,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264"],"published":"2015-11-02T20:21:29Z","modified":"2026-09-09T06:47:32Z","fixes":[{"ecosystem":"Debian:12","package":"mediawiki","fixed_in":["1:1.25.5-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"mediawiki","fixed_in":["1:1.25.5-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mediawiki","fixed_in":["1:1.25.5-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.25.5-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.25.5-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.25.5-1"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.11-1.mga5"}]}],"bundled":5}],"products":[{"vendor":"mediawiki","product":"mediawiki"}],"references":[{"url":"https://phabricator.wikimedia.org/T95589","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","report"]},{"url":"http://www.securitytracker.com/id/1034028","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-October/000181.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Patch","Vendor Advisory","advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8004"},{"url":"https://github.com/advisories/GHSA-xg2h-3f4g-42hc"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-8004","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0421.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=16990","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2015/10/29/14","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-8004","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-8004","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-8004","description":"MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not properly restrict access to revisions, which allows remote authenticated users with the viewsuppressed user right to remove revision suppressions via a crafted revisiondelete action, which returns a valid a change form.","status":"published","published":"2015-11-09T18:00:00Z","modified":"2024-08-06T08:06:31.578Z","updated_at":"2026-11-02T14:35:41.26549Z"}],"euvd":[{"id":"EUVD-2015-7900","description":"MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not properly restrict access to revisions, which allows remote authenticated users with the viewsuppressed user right to remove revision suppressions via a crafted revisiondelete action, which returns a valid a change form.","status":"published","published":"2015-11-09T18:00:00Z","modified":"2024-08-06T08:06:31Z","updated_at":"2026-11-03T02:21:50.339607Z"}],"ghsa":[{"id":"GHSA-xg2h-3f4g-42hc","title":"MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not properly...","description":"MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not properly restrict access to revisions, which allows remote authenticated users with the viewsuppressed user right to remove revision suppressions via a crafted revisiondelete action, which returns a valid a change form.","status":"published","published":"2022-05-17T04:02:39Z","modified":"2023-01-28T05:00:57Z","updated_at":"2026-11-02T14:43:26.967621Z"}],"nvd":[{"id":"CVE-2015-8004","description":"MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not properly restrict access to revisions, which allows remote authenticated users with the viewsuppressed user right to remove revision suppressions via a crafted revisiondelete action, which returns a valid a change form.","status":"published","published":"2015-11-09T18:59:03.897Z","modified":"2026-06-17T00:33:51.35Z","cvss":[{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:03:12.30866Z"}],"osv":[{"id":"CVE-2015-8004","description":"MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not properly restrict access to revisions, which allows remote authenticated users with the viewsuppressed user right to remove revision suppressions via a crafted revisiondelete action, which returns a valid a change form.","status":"published","published":"2015-11-09T18:59:03Z","modified":"2026-04-16T06:23:57.001186537Z","updated_at":"2026-11-02T15:44:01.068991Z"},{"id":"DEBIAN-CVE-2015-8004","description":"MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not properly restrict access to revisions, which allows remote authenticated users with the viewsuppressed user right to remove revision suppressions via a crafted revisiondelete action, which returns a valid a change form.","status":"published","published":"2015-11-09T18:59:03.897Z","modified":"2026-09-09T06:47:32.591202096Z","updated_at":"2026-11-02T15:45:27.04239Z"},{"id":"MGASA-2015-0421","title":"Updated mediawiki packages fix security vulnerabilities","description":"Updated mediawiki packages fix security vulnerabilities:\n\nIn MediaWiki before 1.23.11, the API failed to correctly stop adding new\nchunks to the upload when the reported size was exceeded, allowing a\nmalicious user to upload add an infinite number of chunks for a single file\nupload (CVE-2015-8001).\n\nIn MediaWiki before 1.23.11, a malicious user could upload chunks of 1 byte\nfor very large files, potentially creating a very large number of files on\nthe server's filesystem (CVE-2015-8002).\n\nIn MediaWiki before 1.23.11, it is not possible to throttle file uploads,\nor in other words, rate limit them (CVE-2015-8003).\n\nIn MediaWiki before 1.23.11, a missing authorization check when removing\nsuppression from a revision allowed users with the 'viewsuppressed' user\nright but not the appropriate 'suppressrevision' user right to unsuppress\nrevisions (CVE-2015-8004).\n\nIn MediaWiki before 1.23.11, thumbnails of PNG files generated with\nImageMagick contained the local file path in the image (CVE-2015-8005).\n","status":"published","published":"2015-11-02T20:21:29Z","modified":"2026-04-16T06:26:14.079020702Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"UBUNTU-CVE-2015-8004","description":"MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not properly restrict access to revisions, which allows remote authenticated users with the viewsuppressed user right to remove revision suppressions via a crafted revisiondelete action, which returns a valid a change form.","status":"withdrawn","published":"2015-11-09T18:59:00Z","modified":"2025-07-16T07:17:37.996834Z","updated_at":"2026-11-02T15:54:10.737723Z"}]}}