CVE-2011-4361

MediaWiki before 1.17.1 does not check for read permission before handling action=ajax requests, which allows remote attackers to obtain sensitive information by (1) leveraging the SpecialUpload::ajaxGetExistsWarning function, or by (2) leveraging an extension, as demonstrated by the CategoryTree, ExtTab, and InlineEditor extensions.

MediaWiki before 1.17.1 does not check for read permission before handling action=ajax requests, which allows remote attackers to obtain sensitive information by (1) leveraging the SpecialUpload::ajaxGetExistsWarning function, or by (2) leveraging an extension, as demonstrated by the CategoryTree, ExtTab, and InlineEditor extensions.

MediaWiki, antes de v1.17.1, no comprueba los permisos de lectura antes de manejar las peticiones action=ajax, lo que permite a atacantes remotos obtener información sensible (1) aprovechandose de la función SpecialUpload::ajaxGetExistsWarning, o (2) aprovechando una extensión, como lo demuestra las extensiones CategoryTree, ExtTab y InlineEditor.