High severity7.5NVD Advisory· Published Apr 20, 2017· Updated May 13, 2026
CVE-2016-6335
CVE-2016-6335
Description
MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 does not generate head items in the context of a given title, which allows remote attackers to obtain sensitive information via a parse action to api.php.
Affected products
7cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*+ 6 more
- cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*range: <=1.23.14
- cpe:2.3:a:mediawiki:mediawiki:1.26.0:*:*:*:*:*:*:*
- cpe:2.3:a:mediawiki:mediawiki:1.26.1:*:*:*:*:*:*:*
- cpe:2.3:a:mediawiki:mediawiki:1.26.2:*:*:*:*:*:*:*
- cpe:2.3:a:mediawiki:mediawiki:1.26.3:*:*:*:*:*:*:*
- cpe:2.3:a:mediawiki:mediawiki:1.26.4:*:*:*:*:*:*:*
- cpe:2.3:a:mediawiki:mediawiki:1.27.0:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4- lists.wikimedia.org/pipermail/mediawiki-announce/2016-August/000195.htmlnvdMailing ListPatchVendor Advisory
- phabricator.wikimedia.org/T139570nvdPatchThird Party Advisory
- phabricator.wikimedia.org/T139565nvdThird Party Advisory
- bugzilla.redhat.com/show_bug.cginvdIssue Tracking
News mentions
0No linked articles in our index yet.