| Name | CVE-2015-8004 |
| Description | MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not properly restrict access to revisions, which allows remote authenticated users with the viewsuppressed user right to remove revision suppressions via a crafted revisiondelete action, which returns a valid a change form. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| mediawiki (PTS) | buster | 1:1.31.16-1+deb10u2 | fixed |
| buster (security) | 1:1.31.16-1+deb10u7 | fixed | |
| bullseye | 1:1.35.13-1~deb11u1 | fixed | |
| bullseye (security) | 1:1.35.13-1+deb11u2 | fixed | |
| bookworm | 1:1.39.5-1~deb12u1 | fixed | |
| bookworm (security) | 1:1.39.7-1~deb12u1 | fixed | |
| sid, trixie | 1:1.39.7-1 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| mediawiki | source | squeeze | (unfixed) | end-of-life | ||
| mediawiki | source | (unstable) | 1:1.25.5-1 |
[wheezy] - mediawiki <no-dsa> (Minor issues)
[squeeze] - mediawiki <end-of-life> (Not supported in Squeeze LTS)
https://phabricator.wikimedia.org/T95589