Medium severity6.5NVD Advisory· Published Apr 20, 2017· Updated May 13, 2026
CVE-2016-6336
CVE-2016-6336
Description
MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote authenticated users with undelete permissions to bypass intended suppressrevision and deleterevision restrictions and remove the revision deletion status of arbitrary file revisions by using Special:Undelete.
Affected products
7cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*+ 6 more
- cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*range: <=1.23.14
- cpe:2.3:a:mediawiki:mediawiki:1.26.0:*:*:*:*:*:*:*
- cpe:2.3:a:mediawiki:mediawiki:1.26.1:*:*:*:*:*:*:*
- cpe:2.3:a:mediawiki:mediawiki:1.26.2:*:*:*:*:*:*:*
- cpe:2.3:a:mediawiki:mediawiki:1.26.3:*:*:*:*:*:*:*
- cpe:2.3:a:mediawiki:mediawiki:1.26.4:*:*:*:*:*:*:*
- cpe:2.3:a:mediawiki:mediawiki:1.27.0:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- lists.wikimedia.org/pipermail/mediawiki-announce/2016-August/000195.htmlnvdMailing ListPatchVendor Advisory
- phabricator.wikimedia.org/T132926nvdPatchThird Party Advisory
- bugzilla.redhat.com/show_bug.cginvdIssue Tracking
News mentions
0No linked articles in our index yet.