| Package | Affected versions | Patched versions |
|---|---|---|
| mediawiki | ≤ 1.35.0 |
The FileImporter extension in MediaWiki through 1.35.0 was not properly attributing various user actions to a specific user's IP address. Instead, for various actions, it would report the IP address of an internal Wikimedia Foundation server by omitting X-Forwarded-For data. This resulted in an inability to properly audit and attribute various user actions performed via the FileImporter extension.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free