{"action":"Upgrade mediawiki/core to 1.31.8 or later.","affected":[{"fixed":"1.31.8","introduced":"0"},{"fixed":"1.33.4","introduced":"1.32.0"},{"fixed":"1.34.2","introduced":"1.34.0"}],"component":"mediawiki/core","cve_ids":["CVE-2020-15005"],"ecosystem":"Packagist","epss":0.01302,"exploited":false,"fixed_versions":["1.31.8","1.33.4","1.34.2"],"ghsa_id":"GHSA-xpv7-93cm-4mxv","id":"tcs_01M5KFB895KD6E0Y0B5A8DJFBM","modified_at":"2024-12-02T05:51:39.267984Z","published_at":"2022-05-24T17:21:40Z","references":["https://osv.dev/vulnerability/GHSA-xpv7-93cm-4mxv","https://nvd.nist.gov/vuln/detail/CVE-2020-15005","https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/core/+/REL1_31/RELEASE-NOTES-1.31","https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/core/+/REL1_33/RELEASE-NOTES-1.33","https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/core/+/REL1_34/RELEASE-NOTES-1.34","https://github.com/wikimedia/mediawiki","https://lists.debian.org/debian-lts-announce/2020/12/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EEZIMLJMJS72SJXPYL736XMUAVCRQD2H","https://lists.wikimedia.org/pipermail/wikitech-l/2020-June/093535.html","https://phabricator.wikimedia.org/T248947","https://www.debian.org/security/2020/dsa-4767"],"severity":{"label":"low","score":3.1},"sources":[{"source":"osv","source_id":"GHSA-xpv7-93cm-4mxv","url":"https://osv.dev/vulnerability/GHSA-xpv7-93cm-4mxv"},{"source":"nvd","source_id":"CVE-2020-15005","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15005"}],"summary":"img_auth.php may leak private extension images into the public cache"}