{"api_version":"1","generated_at":"2026-07-23T18:57:15+00:00","cve":"CVE-2016-6336","urls":{"html":"https://cve.report/CVE-2016-6336","api":"https://cve.report/api/cve/CVE-2016-6336.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2016-6336","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2016-6336"},"summary":{"title":"CVE-2016-6336","description":"MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote authenticated users with undelete permissions to bypass intended suppressrevision and deleterevision restrictions and remove the revision deletion status of arbitrary file revisions by using Special:Undelete.","state":"PUBLISHED","assigner":"redhat","published_at":"2017-04-20 17:59:00","updated_at":"2025-04-20 01:37:25"},"problem_types":["CWE-284","n/a"],"metrics":[{"version":"3.0","source":"nvd@nist.gov","type":"Primary","score":"6.5","severity":"MEDIUM","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","data":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"}},{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4","severity":"","vector":"AV:N/AC:L/Au:S/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N","baseScore":4,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"https://phabricator.wikimedia.org/T132926","name":"https://phabricator.wikimedia.org/T132926","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"],"title":"⚓ T132926 Admins can get around oversight (suppression) of file revisions","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.wikimedia.org/pipermail/mediawiki-announce/2016-August/000195.html","name":"https://lists.wikimedia.org/pipermail/mediawiki-announce/2016-August/000195.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Patch","Vendor Advisory"],"title":"[MediaWiki-announce] Security Release - 1.27.1, 1.26.4, 1.23.15","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1369613","name":"https://bugzilla.redhat.com/show_bug.cgi?id=1369613","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking"],"title":"1369613 – (CVE-2016-6331, CVE-2016-6332, CVE-2016-6333, CVE-2016-6334, CVE-2016-6335, CVE-2016-6336) CVE-2016-6331 CVE-2016-6332 CVE-2016-6333 CVE-2016-6334 CVE-2016-6335 CVE-2016-6336 mediawiki: multiple flaws fixed in 1.27.1, 1.26.4 and 1.23.15","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-6336","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6336","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2016","cve_id":"6336","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mediawiki","cpe5":"mediawiki","cpe6":"1.26.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"6336","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mediawiki","cpe5":"mediawiki","cpe6":"1.26.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"6336","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mediawiki","cpe5":"mediawiki","cpe6":"1.26.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"6336","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mediawiki","cpe5":"mediawiki","cpe6":"1.26.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"6336","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mediawiki","cpe5":"mediawiki","cpe6":"1.26.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"6336","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mediawiki","cpe5":"mediawiki","cpe6":"1.27.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"6336","vulnerable":"1","versionEndIncluding":"1.23.14","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mediawiki","cpe5":"mediawiki","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T01:29:19.386Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"[MediaWiki-announce] 20160823 Security Release - 1.27.1, 1.26.4, 1.23.15","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"https://lists.wikimedia.org/pipermail/mediawiki-announce/2016-August/000195.html"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1369613"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://phabricator.wikimedia.org/T132926"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2016-08-23T00:00:00.000Z","descriptions":[{"lang":"en","value":"MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote authenticated users with undelete permissions to bypass intended suppressrevision and deleterevision restrictions and remove the revision deletion status of arbitrary file revisions by using Special:Undelete."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-04-20T16:57:02.000Z","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat"},"references":[{"name":"[MediaWiki-announce] 20160823 Security Release - 1.27.1, 1.26.4, 1.23.15","tags":["mailing-list","x_refsource_MLIST"],"url":"https://lists.wikimedia.org/pipermail/mediawiki-announce/2016-August/000195.html"},{"tags":["x_refsource_CONFIRM"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1369613"},{"tags":["x_refsource_CONFIRM"],"url":"https://phabricator.wikimedia.org/T132926"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"secalert@redhat.com","ID":"CVE-2016-6336","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote authenticated users with undelete permissions to bypass intended suppressrevision and deleterevision restrictions and remove the revision deletion status of arbitrary file revisions by using Special:Undelete."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"[MediaWiki-announce] 20160823 Security Release - 1.27.1, 1.26.4, 1.23.15","refsource":"MLIST","url":"https://lists.wikimedia.org/pipermail/mediawiki-announce/2016-August/000195.html"},{"name":"https://bugzilla.redhat.com/show_bug.cgi?id=1369613","refsource":"CONFIRM","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1369613"},{"name":"https://phabricator.wikimedia.org/T132926","refsource":"CONFIRM","url":"https://phabricator.wikimedia.org/T132926"}]}}}},"cveMetadata":{"assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","assignerShortName":"redhat","cveId":"CVE-2016-6336","datePublished":"2017-04-20T17:00:00.000Z","dateReserved":"2016-07-26T00:00:00.000Z","dateUpdated":"2024-08-06T01:29:19.386Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2017-04-20 17:59:00","lastModifiedDate":"2025-04-20 01:37:25","problem_types":["CWE-284","n/a"],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N","baseScore":4,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*","versionEndIncluding":"1.23.14","matchCriteriaId":"F26807BC-B2F2-480D-B5B1-C2D64933A0C8"},{"vulnerable":true,"criteria":"cpe:2.3:a:mediawiki:mediawiki:1.26.0:*:*:*:*:*:*:*","matchCriteriaId":"7B418525-DAC2-461A-B931-BED05CC3AFBF"},{"vulnerable":true,"criteria":"cpe:2.3:a:mediawiki:mediawiki:1.26.1:*:*:*:*:*:*:*","matchCriteriaId":"8C238723-5592-4F0F-869D-91B64DD14FBF"},{"vulnerable":true,"criteria":"cpe:2.3:a:mediawiki:mediawiki:1.26.2:*:*:*:*:*:*:*","matchCriteriaId":"22685E70-3EE0-484B-8A4C-139C28BDD2B1"},{"vulnerable":true,"criteria":"cpe:2.3:a:mediawiki:mediawiki:1.26.3:*:*:*:*:*:*:*","matchCriteriaId":"3BD0A725-B06B-456D-8A8B-9DA5468935FA"},{"vulnerable":true,"criteria":"cpe:2.3:a:mediawiki:mediawiki:1.26.4:*:*:*:*:*:*:*","matchCriteriaId":"7ED98FFC-4397-4F27-AC36-BB7A42A92F89"},{"vulnerable":true,"criteria":"cpe:2.3:a:mediawiki:mediawiki:1.27.0:*:*:*:*:*:*:*","matchCriteriaId":"F75E06F7-6D23-4BEB-80B4-3DE33193CA95"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2016","CveId":"6336","Ordinal":"1","Title":"CVE-2016-6336","CVE":"CVE-2016-6336","Year":"2016"},"notes":[{"CveYear":"2016","CveId":"6336","Ordinal":"1","NoteData":"MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote authenticated users with undelete permissions to bypass intended suppressrevision and deleterevision restrictions and remove the revision deletion status of arbitrary file revisions by using Special:Undelete.","Type":"Description","Title":"CVE-2016-6336"},{"CveYear":"2016","CveId":"6336","Ordinal":"2","NoteData":"2017-04-20","Type":"Other","Title":"Published"},{"CveYear":"2016","CveId":"6336","Ordinal":"3","NoteData":"2017-04-20","Type":"Other","Title":"Modified"}]}}}