CVE-2011-0537
Summary
| CVE | CVE-2011-0537 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2011-02-04 01:00:07 UTC |
| Updated | 2026-04-29 01:13:23 UTC |
| Description | Multiple directory traversal vulnerabilities in (1) languages/Language.php and (2) includes/StubObject.php in MediaWiki 1.8.0 and other versions before 1.16.2, when running on Windows and possibly Novell Netware, allow remote attackers to include and execute arbitrary local PHP files via vectors related to a crafted language file and the Language::factory function. |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
LowAuthentication
NoneConfidentiality
PartialIntegrity
PartialAvailability
PartialAV:N/AC:L/Au:N/C:P/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Mediawiki | Mediawiki | 1.10.0 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.10.0 | rc1 | All | All |
| Application | Mediawiki | Mediawiki | 1.10.0 | rc2 | All | All |
| Application | Mediawiki | Mediawiki | 1.10.1 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.10.2 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.10.3 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.10.4 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.11 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.11 | rc1 | All | All |
| Application | Mediawiki | Mediawiki | 1.11.0 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.11.0 | rc1 | All | All |
| Application | Mediawiki | Mediawiki | 1.11.0rc1 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.11.1 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.11.2 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.11_development | All | All | All |
| Application | Mediawiki | Mediawiki | 1.12.0 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.12.0 | rc1 | All | All |
| Application | Mediawiki | Mediawiki | 1.12.1 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.12.2 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.12.3 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.12.4 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.13.0 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.13.0 | rc1 | All | All |
| Application | Mediawiki | Mediawiki | 1.13.0 | rc2 | All | All |
| Application | Mediawiki | Mediawiki | 1.13.1 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.13.2 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.13.3 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.13.4 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.14.0 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.14.0 | rc1 | All | All |
| Application | Mediawiki | Mediawiki | 1.14.1 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.15.0 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.15.0 | rc1 | All | All |
| Application | Mediawiki | Mediawiki | 1.15.1 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.15.2 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.15.3 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.16.0 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.16.0 | beta1 | All | All |
| Application | Mediawiki | Mediawiki | 1.16.0 | beta2 | All | All |
| Application | Mediawiki | Mediawiki | 1.16.1 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.8.0 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.8.1 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.8.2 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.8.3 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.8.4 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.8.5 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.9.0 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.9.0 | rc2 | All | All |
| Application | Mediawiki | Mediawiki | 1.9.1 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.9.2 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.9.3 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.9.4 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.9.5 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.9.6 | All | All | All |
| Operating System | Microsoft | Windows | All | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Bug 27094 – Language file path traversal | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.wikimedia.org | |
| oss-security - CVE request: Server-side arbitrary script inclusion vulnerability in MediaWiki <=1.16.1 | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | |
| osvdb.org/70799 | af854a3a-2127-422b-91ae-364da2661108 | osvdb.org | |
| oss-security - Re: CVE request: Server-side arbitrary script inclusion vulnerability in MediaWiki <=1.16.1 | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | |
| osvdb.org/70798 | af854a3a-2127-422b-91ae-364da2661108 | osvdb.org | |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | Vendor Advisory |
| [MediaWiki-announce] MediaWiki security release 1.16.2 | af854a3a-2127-422b-91ae-364da2661108 | lists.wikimedia.org | Patch |
| download.wikimedia.org/mediawiki/1.16/mediawiki-1.16.2.patch.gz | af854a3a-2127-422b-91ae-364da2661108 | download.wikimedia.org | Patch |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.