VYPR
← All advisories
Low severity3.1NVD Advisory· Published Jun 24, 2020· Updated Jun 17, 2026

CVE-2020-15005

CVE-2020-15005

Description

In MediaWiki before 1.31.8, 1.32.x and 1.33.x before 1.33.4, and 1.34.x before 1.34.2, private wikis behind a caching server using the img_auth.php image authorization security feature may have had their files cached publicly, so any unauthorized user could view them. This occurs because Cache-Control and Vary headers were mishandled.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
mediawiki/corePackagist
< 1.31.81.31.8
mediawiki/corePackagist
>= 1.32.0, < 1.33.41.33.4
mediawiki/corePackagist
>= 1.34.0, < 1.34.21.34.2

Affected products

7
  • MediaWiki/Mediawiki2 versions
    cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*range: <1.31.8
    • (no CPE)
  • Fedoraproject/Fedora
    cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
  • Debian/linux2 versions
    cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
    • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
  • ghsa-coords2 versions
    pkg:composer/mediawiki/corepkg:bitnami/mediawiki
    < 1.31.8+ 1 more
    • (no CPE)range: < 1.31.8
    • (no CPE)range: < 1.31.8

Patches

Vulnerability mechanics

References

11

News mentions

0

No linked articles in our index yet.