CVE-2023-36674

Summary

CVE-2023-36674 is a vulnerability affecting MediaWiki versions before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x before 1.39.4, and 1.40.x before 1.40.1. This issue permits bypassing the Bad image list (aka badFile) by utilizing the thumb parameter (aka Manualthumb) within the File syntax. This vulnerability could potentially lead to unintended image access, posing a security risk for MediaWiki installations. Users are encouraged to upgrade their MediaWiki installations to the patched versions to mitigate this threat.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.