MediaWiki before 1.23.16, 1.24.x through 1.27.x before 1.27.2, and 1.28.x before 1.28.1 allows remote attackers to discover the IP addresses of Wiki visitors via a style="background-image: attr(title url);" attack within a DIV element that has an attacker-controlled URL in the title attribute.

According to its self-reported version number, the instance of MediaWiki hosted on the remote web server is prior to 1.23.16, 1.24.x prior to 1.27.2 or 1.28.x prior to 1.28.1 . It is, therefore, affected by a flaw which may allow remote attackers to discover the IP addresses of Wiki Visitors via a style tag within a DIV element with a attacker-controlled URL in the title attribute.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
114002	MediaWiki 1.28.x < 1.28.1 Wiki Visitor IP Leakage	Web App Scanning	Component Vulnerability	high
114001	MediaWiki 1.24.x < 1.27.2 Wiki Visitor IP Leakage	Web App Scanning	Component Vulnerability	high
114000	MediaWiki < 1.23.16 Wiki Visitor IP Leakage	Web App Scanning	Component Vulnerability	high

Detections

Analytics

CVE-2017-0371

high

Tenable Plugins

high

high

high