| Package | Affected versions | Patched versions |
|---|---|---|
| mediawiki | ≥ 1.24.0, < 1.27.2≥ 1.28.0, < 1.28.1< 1.23.16 | 1.27.21.28.11.23.16 |
MediaWiki before 1.23.16, 1.24.x through 1.27.x before 1.27.2, and 1.28.x before 1.28.1 allows remote attackers to discover the IP addresses of Wiki visitors via a style="background-image: attr(title url);" attack within a DIV element that has an attacker-controlled URL in the title attribute.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free