CVE-2016-6336

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote authenticated users with undelete permissions to bypass intended suppressrevision and deleterevision restrictions and remove the revision deletion status of arbitrary file revisions by using Special:Undelete.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://bugzilla.redhat.com/show_bug.cgi?id=1369613Issue Tracking
https://lists.wikimedia.org/pipermail/mediawiki-announce/2016-August/000195.htmlMailing List, Patch, Vendor Advisory
https://phabricator.wikimedia.org/T132926Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1369613Issue Tracking
https://lists.wikimedia.org/pipermail/mediawiki-announce/2016-August/000195.htmlMailing List, Patch, Vendor Advisory
https://phabricator.wikimedia.org/T132926Patch, Third Party Advisory

Timeline

Published: Apr 20, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-63377.5MediaWiki 1.27.x before 1.27.1 might allow remote attackers to bypass intended session access restrictions by leveraging a call to the UserG CVE-2016-63386.8ovirt-engine-webadmin, as used in Red Hat Enterprise Virtualization Manager (aka RHEV-M) for Servers and RHEV-M 4.0, allows physically proxi CVE-2016-63408.4The kickstart file in Red Hat QuickStart Cloud Installer (QCI) forces use of MD5 passwords on deployed systems, which makes it easier for at CVE-2016-63415.5oVirt Engine before 4.0.3 does not include DWH_DB_PASSWORD in the list of keys to hide in log files, which allows local users to obtain sens CVE-2016-63427.5elog 3.1.1 allows remote attackers to post data as any username in the logbook.CVE-2016-63435.4JBoss BPM Suite 6 is vulnerable to a reflected XSS via dashbuilder. Remote attackers can entice authenticated users that have privileges to CVE-2016-63445.3Red Hat JBoss BPM Suite 6.3.x does not include the HTTPOnly flag in a Set-Cookie header for session cookies, which makes it easier for remot CVE-2016-63456.5RESTEasy allows remote authenticated users to obtain sensitive information by leveraging "insufficient use of random values" in async jobs.CVE-2016-63467.5RESTEasy enables GZIPInterceptor, which allows remote attackers to cause a denial of service via unspecified vectors.CVE-2016-63476.1Cross-site scripting (XSS) vulnerability in the default exception handler in RESTEasy allows remote attackers to inject arbitrary web script CVE-2016-63486.1JacksonJsonpInterceptor in RESTEasy might allow remote attackers to conduct a cross-site script inclusion (XSSI) attack.CVE-2016-63493.3The machinectl command in oci-register-machine allows local users to list running containers and possibly obtain sensitive information by ru