The chunked upload API (ApiUpload) in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not restrict the uploaded data to the claimed file size, which allows remote authenticated users to cause a denial of service via a chunk that exceeds the file size.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2015-11-09T18:00:00
Updated: 2024-08-06T08:06:31.520Z
Reserved: 2015-10-28T00:00:00
Link: CVE-2015-8001
Vulnrichment
No data.
NVD
Status : Analyzed
Published: 2015-11-09T18:59:00.113
Modified: 2015-11-10T17:50:02.520
Link: CVE-2015-8001
Redhat
No data.