MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not throttle file uploads, which allows remote authenticated users to have unspecified impact via multiple file uploads.

The version of MediaWiki installed is 1.23.x earlier than 1.23.11, 1.24.x earlier than 1.24.4, or 1.25.x earlier than 1.25.3. Therefore, it is affected by multiple vulnerabilities :

 - A flaw exists in the Chunked Upload API that is due to the program failing to stop adding new chunks to the upload when the reported size was exceeded. This may allow a remote attacker to upload a potentially infinite number of chunks for a single file upload and exhaust available disk space on the server. (CVE-2015-8001)
 - A flaw in the Chunked Upload API may allow a remote attacker to upload files in chunks of 1 byte. This may allow the attacker to create an excessively large number of files on the server. (CVE-2015-8002)
 - A flaw exists due to a missing file upload throttling feature, which can allow remote attackers to cause excessive stress on the server. (CVE-2015-8003)
 - A flaw exists that is triggered as authorization checks are missing when removing a suppression from a revision. This may allow an unauthorized, but authenticated, remote attacker to remove a revision suppression. (CVE-2015-8004)
 - A flaw exists that is triggered as thumbnails of PNG files that are created with ImageMagick contain potentially sensitive information. This may allow a remote attacker to gain access to local file path information. (CVE-2015-8005)

https://www.mediawiki.org/wiki/Release_notes/1.25#MediaWiki_1.25.3

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

https://www.mediawiki.org/wiki/Release_notes/1.24#MediaWiki_1.24.4

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

MediaWiki reports :

Wikipedia user RobinHood70 reported two issues in the chunked upload API. The API failed to correctly stop adding new chunks to the upload when the reported size was exceeded (T91203), allowing a malicious users to upload add an infinite number of chunks for a single file upload. Additionally, a malicious user could upload chunks of 1 byte for very large files, potentially creating a very large number of files on the server's filesystem (T91205).

Internal review discovered that it is not possible to throttle file uploads.

Internal review discovered a missing authorization check when removing suppression from a revision. This allowed users with the 'viewsuppressed' user right but not the appropriate 'suppressrevision' user right to unsuppress revisions.

Richard Stanway from teamliquid.net reported that thumbnails of PNG files generated with ImageMagick contained the local file path in the image metadata.

ID	Name	Product	Family	Severity
9472	MediaWiki < 1.23.11 / 1.24.4 / 1.25.3 Multiple Vulnerabilities	Nessus Network Monitor	CGI	medium
89450	Fedora 23 : mediawiki-1.25.3-1.fc23 (2015-ec6d598d3d)	Nessus	Fedora Local Security Checks	critical
89332	Fedora 21 : mediawiki-1.24.4-1.fc21 (2015-97fe05f788)	Nessus	Fedora Local Security Checks	critical
89179	Fedora 22 : mediawiki-1.25.3-1.fc22 (2015-24fe8b66c9)	Nessus	Fedora Local Security Checks	critical
86554	FreeBSD : mediawiki -- multiple vulnerabilities (b973a763-7936-11e5-a2a1-002590263bf5)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2015-8003

high

Tenable Plugins

medium

critical

critical

critical

critical