{"id":"CVE-2023-36674","aliases":["BIT-mediawiki-2023-36674","DEBIAN-CVE-2023-36674","DSA-5447-1","EUVD-2023-40617","GHSA-5998-5c6q-8v55","MGASA-2023-0241","UBUNTU-CVE-2023-36674"],"status":"published","title":"An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x...","description":"An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x before 1.39.4, and 1.40.x before 1.40.1. It is possible to bypass the Bad image list (aka badFile) by using the thumb parameter (aka Manualthumb) of the File syntax.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00737,"percentile":0.5496,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2023-07-05T00:00:00Z","modified":"2026-10-28T02:31:14Z","fixes":[{"ecosystem":"Bitnami","package":"mediawiki","fixed_in":["1.35.11","1.38.7","1.39.4","1.40.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"mediawiki","fixed_in":["1:1.39.4-1~deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"mediawiki","fixed_in":["1:1.39.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mediawiki","fixed_in":["1:1.39.4-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"mediawiki","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.35.11"},{"introduced":"1.36.0"},{"fixed":"1.38.7"},{"introduced":"1.39.0"},{"fixed":"1.39.4"},{"introduced":"1.40.0"},{"fixed":"1.40.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.39.4-1~deb12u1"}]}],"versions":["1:1.39.2-1"]},{"source":"osv","ecosystem":"Debian:13","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.39.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.39.4-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.35.11-1~deb11u1"}]}],"versions":["1:1.35.2-1","1:1.35.3-1","1:1.35.4-1","1:1.35.4-1+deb11u2","1:1.35.4-1~deb11u1","1:1.35.5-1","1:1.35.5-2","1:1.35.6-1","1:1.35.7-1","1:1.35.8-1","1:1.35.8-1.1","1:1.35.8-1~deb11u1"],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.39.4-1~deb12u1"}]}],"versions":["1:1.39.2-1"],"bundled":3},{"source":"osv","ecosystem":"Mageia:8","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.11-1.mga8"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.27.3-1","1:1.27.4-1","1:1.27.4-2","1:1.27.4-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.31.2-1ubuntu1","1:1.31.5-1","1:1.31.5-1ubuntu1","1:1.31.5-2","1:1.31.5-3","1:1.31.5-3ubuntu1","1:1.31.6-1","1:1.31.7-1","1:1.31.7-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.35.3-1","1:1.35.4-1","1:1.35.5-1","1:1.35.5-1ubuntu1","1:1.35.5-1ubuntu2","1:1.35.5-1ubuntu3","1:1.35.6-1","1:1.35.6-1ubuntu0.1~esm1"]}],"products":[{"vendor":"mediawiki","product":"mediawiki"}],"references":[{"url":"https://phabricator.wikimedia.org/T335612","tags":["x_transferred","Issue Tracking","Patch","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DOAXEGYBOEM4JWB4J3BDH73NK2LCYC3O/","tags":["vendor-advisory","x_transferred","web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2UIVGYECQGTUC2LLPVCZBPDLCTOHL2F6/","tags":["vendor-advisory","x_transferred","web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CHRX6DSLAMVXCV2YMJEWOLTBEYSESE5/","tags":["vendor-advisory","x_transferred","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-36674","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2UIVGYECQGTUC2LLPVCZBPDLCTOHL2F6"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CHRX6DSLAMVXCV2YMJEWOLTBEYSESE5"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DOAXEGYBOEM4JWB4J3BDH73NK2LCYC3O"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2UIVGYECQGTUC2LLPVCZBPDLCTOHL2F6"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6CHRX6DSLAMVXCV2YMJEWOLTBEYSESE5"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DOAXEGYBOEM4JWB4J3BDH73NK2LCYC3O"},{"url":"https://github.com/advisories/GHSA-5998-5c6q-8v55"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36674.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-36674","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2023-0241.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=32083","tags":["report"]},{"url":"https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/thread/HVT3U3XYY35PSCIQPHMY4VQNF3Q6MHUO/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2023-36674","tags":["report"]},{"url":"https://gerrit.wikimedia.org/r/c/mediawiki/core/+/934571/","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-36674","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-36674","description":"An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x before 1.39.4, and 1.40.x before 1.40.1. It is possible to bypass the Bad image list (aka badFile) by using the thumb parameter (aka Manualthumb) of the File syntax.","status":"published","published":"2023-08-20T00:00:00Z","modified":"2024-10-08T14:27:38.887Z","cwes":["CWE-20"],"updated_at":"2026-11-02T14:35:27.810438Z"}],"euvd":[{"id":"EUVD-2023-40617","description":"An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x before 1.39.4, and 1.40.x before 1.40.1. It is possible to bypass the Bad image list (aka badFile) by using the thumb parameter (aka Manualthumb) of the File syntax.","status":"published","published":"2023-08-20T00:00:00Z","modified":"2024-10-08T14:27:38Z","updated_at":"2026-11-03T00:27:45.808193Z"}],"ghsa":[{"id":"GHSA-5998-5c6q-8v55","title":"An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x...","description":"An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x before 1.39.4, and 1.40.x before 1.40.1. It is possible to bypass the Bad image list (aka badFile) by using the thumb parameter (aka Manualthumb) of the File syntax.","status":"published","published":"2023-08-20T18:30:36Z","modified":"2024-10-08T18:33:05Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:58:26.306971Z"}],"nvd":[{"id":"CVE-2023-36674","description":"An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x before 1.39.4, and 1.40.x before 1.40.1. It is possible to bypass the Bad image list (aka badFile) by using the thumb parameter (aka Manualthumb) of the File syntax.","status":"published","published":"2023-08-20T18:15:09.93Z","modified":"2026-06-17T06:06:48.68Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:08:24.487686Z"}],"osv":[{"id":"DEBIAN-CVE-2023-36674","description":"An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x before 1.39.4, and 1.40.x before 1.40.1. It is possible to bypass the Bad image list (aka badFile) by using the thumb parameter (aka Manualthumb) of the File syntax.","status":"published","published":"2023-08-20T18:15:09.93Z","modified":"2026-10-26T18:02:19.916675387Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:39.980321Z"},{"id":"UBUNTU-CVE-2023-36674","description":"An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x before 1.39.4, and 1.40.x before 1.40.1. It is possible to bypass the Bad image list (aka badFile) by using the thumb parameter (aka Manualthumb) of the File syntax.","status":"published","published":"2023-08-20T18:15:00Z","modified":"2026-05-27T10:17:14.75066936Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:21.882004Z"},{"id":"BIT-mediawiki-2023-36674","description":"An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x before 1.39.4, and 1.40.x before 1.40.1. It is possible to bypass the Bad image list (aka badFile) by using the thumb parameter (aka Manualthumb) of the File syntax.","status":"published","published":"2024-03-06T11:01:24.192Z","modified":"2025-04-03T14:40:37.652Z","updated_at":"2026-11-02T15:28:33.072289Z"},{"id":"CVE-2023-36674","description":"An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x before 1.39.4, and 1.40.x before 1.40.1. It is possible to bypass the Bad image list (aka badFile) by using the thumb parameter (aka Manualthumb) of the File syntax.","status":"published","published":"2023-08-20T00:00:00Z","modified":"2026-10-28T02:31:14.995388665Z","updated_at":"2026-11-02T15:44:32.510144Z"},{"id":"DSA-5447-1","title":"mediawiki - security update","status":"published","published":"2023-07-05T00:00:00Z","modified":"2026-03-09T02:09:50.008099Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"MGASA-2023-0241","title":"Updated mediawiki packages fix security vulnerability","description":"guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP.\nAffected versions are subject to improper header parsing. An attacker\ncould sneak in a newline (\\n) into both the header names and values.\nWhile the specification states that \\r\\n\\r\\n is used to terminate the\nheader list, many servers in the wild will also accept \\n\\n\n(CVE-2023-29197).\n\nManualthumb bypasses badFile lookup (CVE-2023-36674).\n\nXSS in BlockLogFormatter due to unsafe message use (CVE-2023-36675).\n","status":"published","published":"2023-07-26T22:07:49Z","modified":"2026-04-16T04:40:59.67570918Z","updated_at":"2026-11-02T15:49:42.263076Z"}]}}