CVE-2020-15005

2020-06-2400:00:00

ubuntu.com

CVSS2

2.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:H/Au:N/C:P/I:N/A:N

CVSS3

3.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

EPSS

0.002

Percentile

57.8%

JSON

In MediaWiki before 1.31.8, 1.32.x and 1.33.x before 1.33.4, and 1.34.x
before 1.34.2, private wikis behind a caching server using the img_auth.php
image authorization security feature may have had their files cached
publicly, so any unauthorized user could view them. This occurs because
Cache-Control and Vary headers were mishandled.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchmediawiki< anyUNKNOWN
ubuntu20.04noarchmediawiki< anyUNKNOWN
ubuntu20.10noarchmediawiki< 1:1.31.8-1UNKNOWN
ubuntu21.04noarchmediawiki< 1:1.31.8-1UNKNOWN
ubuntu21.10noarchmediawiki< 1:1.31.8-1UNKNOWN
ubuntu22.04noarchmediawiki< 1:1.31.8-1UNKNOWN
ubuntu22.10noarchmediawiki< 1:1.31.8-1UNKNOWN
ubuntu23.04noarchmediawiki< 1:1.31.8-1UNKNOWN
ubuntu23.10noarchmediawiki< 1:1.31.8-1UNKNOWN
ubuntu24.04noarchmediawiki< 1:1.31.8-1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	mediawiki	< any	UNKNOWN
ubuntu	20.04	noarch	mediawiki	< any	UNKNOWN
ubuntu	20.10	noarch	mediawiki	< 1:1.31.8-1	UNKNOWN
ubuntu	21.04	noarch	mediawiki	< 1:1.31.8-1	UNKNOWN
ubuntu	21.10	noarch	mediawiki	< 1:1.31.8-1	UNKNOWN
ubuntu	22.04	noarch	mediawiki	< 1:1.31.8-1	UNKNOWN
ubuntu	22.10	noarch	mediawiki	< 1:1.31.8-1	UNKNOWN
ubuntu	23.04	noarch	mediawiki	< 1:1.31.8-1	UNKNOWN
ubuntu	23.10	noarch	mediawiki	< 1:1.31.8-1	UNKNOWN
ubuntu	24.04	noarch	mediawiki	< 1:1.31.8-1	UNKNOWN