The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
An issue was discovered in the Widgets extension for MediaWiki through 1.35.1. Any user with the ability to edit pages within the Widgets namespace could call any static function within any class (defined within PHP or MediaWiki) via a crafted HTML comment, related to a Smarty template. For example, a person in the Widget Editors group could use \MediaWiki\Shell\Shell::command within a comment.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Mediawiki | — | Upgrade MediaWiki to the latest version | Dec 29, 2020 | Dec 21, 2020 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub