CVE-2015-8004 | BDVDB-2026-72753 Detail

Description#

MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not properly restrict access to revisions, which allows remote authenticated users with the viewsuppressed user right to remove revision suppressions via a crafted revisiondelete action, which returns a valid a change form.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://phabricator.wikimedia.org/T95589
http://www.securitytracker.com/id/1034028
https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-October/000181.html

Exploit#

No public exploit known

History#

Version 12015-11-09Record published in the CVE List.
Version 22024-08-06Most recent update recorded in the CVE List.