« Volver al listado

CVE-2017-0361

Estado: ModificadaAlta (7.8)—

Mediawiki, en versiones anteriores a la 1.28.1, 1.27.2 y la 1.23.16, contiene un error de divulgación de información en el que api.log podría contener contraseñas en texto plano.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Debian — Debian LinuxMediawiki — Mediawiki

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-0361",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 2.1,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@debian.org",
      "affectedData": [
        {
          "vendor": "mediawiki",
          "product": "mediawiki",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-04-13T16:29:00.283",
  "references": [
    {
      "url": "http://www.securitytracker.com/id/1039812",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "security@debian.org"
    },
    {
      "url": "https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-April/000207.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@debian.org"
    },
    {
      "url": "https://phabricator.wikimedia.org/T125177",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "source": "security@debian.org"
    },
    {
      "url": "https://security-tracker.debian.org/tracker/CVE-2017-0361",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@debian.org"
    },
    {
      "url": "http://www.securitytracker.com/id/1039812",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-April/000207.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://phabricator.wikimedia.org/T125177",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security-tracker.debian.org/tracker/CVE-2017-0361",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains an information disclosure flaw, where the api.log might contain passwords in plaintext."
    },
    {
      "lang": "es",
      "value": "Mediawiki, en versiones anteriores a la 1.28.1, 1.27.2 y la 1.23.16, contiene un error de divulgación de información en el que api.log podría contener contraseñas en texto plano."
    }
  ],
  "lastModified": "2026-06-17T00:57:34.180",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "07C776BA-0AEF-4225-AC4C-38753A764076",
              "versionEndIncluding": "1.23.16",
              "versionStartIncluding": "1.23.0"
            },
            {
              "criteria": "cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E9419B89-A512-4C79-8085-2AB9D7A19C85",
              "versionEndExcluding": "1.27.2",
              "versionStartIncluding": "1.27.0"
            },
            {
              "criteria": "cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8ABB422D-95AC-48E6-AEFF-1F2915354494",
              "versionEndExcluding": "1.28.1",
              "versionStartIncluding": "1.28.0"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "16F59A04-14CF-49E2-9973-645477EA09DA"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@debian.org"
}