Missing .htaccess Files in Mediawiki Tarball
Summary
CVE-2018-13258: Mediawiki tarball is missing .htaccess files. Affects mediawiki/core versions >= 1.31.0, < 1.31.1. Fixed in 1.31.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mediawiki is an open-source wiki software package that powers websites like Wikipedia. It provides a platform for collaborative content creation and management. The package includes various features such as user authentication, page editing, and content organization. However, in versions 1.31 before 1.31.1, the provided tarball is missing .htaccess files that are used to protect certain directories from being accessed via the web.
Vulnerability Detail
The missing .htaccess files in the Mediawiki tarball expose directories that should not be web accessible. This can lead to unauthorized access to sensitive files and directories, potentially compromising the security of the application. Attackers may be able to view, modify, or delete critical files, resulting in data breaches or system compromise. The vulnerability has a CVSS score of 5.3, indicating a moderate severity level.
How To Fix
Minimum fixed version
1.31.1
This is the first release that contains the fix.
composer require mediawiki/core:1.31.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. Users are advised to apply the fix by upgrading to the latest version of Mediawiki.
Conclusion
The missing .htaccess files in the Mediawiki tarball pose a moderate security risk by exposing sensitive directories to unauthorized access. Users should promptly upgrade to version 1.31.1 or later to mitigate this vulnerability. For additional support and guidance, contact DevNack.com.
See every vulnerability recorded for mediawiki/core →
FAQ
The vulnerability exposes sensitive directories to unauthorized access, potentially leading to data breaches or system compromise.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your composer.lock file and Vulert will analyze it for vulnerabilities in real-time.
There are no known exploits for this vulnerability at the moment. However, it is important to apply the fix as soon as possible to mitigate the risk.
Yes, if you are unable to upgrade to the latest version of Mediawiki immediately, you can manually add the missing .htaccess files to the vulnerable directories. The necessary .htaccess configurations can be found in the Mediawiki source code repository.
For further support on vulnerability remediation, you can contact info@devnack.com. Their team can provide guidance and assistance in addressing the vulnerability in your Mediawiki installation.
Related vulnerabilities
Recent vulnerabilities recorded for mediawiki/core.
