CVE-2016-6335

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 does not generate head items in the context of a given title, which allows remote attackers to obtain sensitive information via a parse action to api.php.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://bugzilla.redhat.com/show_bug.cgi?id=1369613Issue Tracking
https://lists.wikimedia.org/pipermail/mediawiki-announce/2016-August/000195.htmlMailing List, Patch, Vendor Advisory
https://phabricator.wikimedia.org/T139565Third Party Advisory
https://phabricator.wikimedia.org/T139570Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1369613Issue Tracking
https://lists.wikimedia.org/pipermail/mediawiki-announce/2016-August/000195.htmlMailing List, Patch, Vendor Advisory
https://phabricator.wikimedia.org/T139565Third Party Advisory
https://phabricator.wikimedia.org/T139570Patch, Third Party Advisory

Timeline

Published: Apr 20, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-63366.5MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote authenticated users with undelete permissions to bypa CVE-2016-63377.5MediaWiki 1.27.x before 1.27.1 might allow remote attackers to bypass intended session access restrictions by leveraging a call to the UserG CVE-2016-63386.8ovirt-engine-webadmin, as used in Red Hat Enterprise Virtualization Manager (aka RHEV-M) for Servers and RHEV-M 4.0, allows physically proxi CVE-2016-63408.4The kickstart file in Red Hat QuickStart Cloud Installer (QCI) forces use of MD5 passwords on deployed systems, which makes it easier for at CVE-2016-63415.5oVirt Engine before 4.0.3 does not include DWH_DB_PASSWORD in the list of keys to hide in log files, which allows local users to obtain sens CVE-2016-63427.5elog 3.1.1 allows remote attackers to post data as any username in the logbook.CVE-2016-63435.4JBoss BPM Suite 6 is vulnerable to a reflected XSS via dashbuilder. Remote attackers can entice authenticated users that have privileges to CVE-2016-63445.3Red Hat JBoss BPM Suite 6.3.x does not include the HTTPOnly flag in a Set-Cookie header for session cookies, which makes it easier for remot CVE-2016-63456.5RESTEasy allows remote authenticated users to obtain sensitive information by leveraging "insufficient use of random values" in async jobs.CVE-2016-63467.5RESTEasy enables GZIPInterceptor, which allows remote attackers to cause a denial of service via unspecified vectors.CVE-2016-63476.1Cross-site scripting (XSS) vulnerability in the default exception handler in RESTEasy allows remote attackers to inject arbitrary web script CVE-2016-63486.1JacksonJsonpInterceptor in RESTEasy might allow remote attackers to conduct a cross-site script inclusion (XSSI) attack.