img_auth.php may leak private extension images into the public cache
Moderate severity
GitHub Reviewed
Published
May 24, 2022
to the GitHub Advisory Database
•
Updated Nov 1, 2024
Package
Affected versions
< 1.31.8
>= 1.32.0, < 1.33.4
>= 1.34.0, < 1.34.2
Patched versions
1.31.8
1.33.4
1.34.2
Description
Published by the National Vulnerability Database
Jun 24, 2020
Published to the GitHub Advisory Database
May 24, 2022
Reviewed
Nov 1, 2024
Last updated
Nov 1, 2024
Credits
-
Rudloff Analyst
In MediaWiki before 1.31.8, 1.32.x and 1.33.x before 1.33.4, and 1.34.x before 1.34.2, private wikis behind a caching server using the img_auth.php image authorization security feature may have had their files cached publicly, so any unauthorized user could view them. This occurs because Cache-Control and Vary headers were mishandled.
References