MediaWiki Cascading Protection Bypass on File Description Pages (CVE-2015-32697)

Key Information Vulnerability Title: Cascading protection doesn't apply to transcluded file description pages Version: 1.23.0 Severity: minor Status: Closed, Resolved Publicity: Public Tags: BUG REPORT Description If a cascading-protected page transcludes a file description page (not displaying the corresponding file, if any), the file description page will not inherit cascading protection. However, any content transcluded from the file description page (except other file description pages) will correctly inherit the protection. Related Objects Mentions: T46490#6-CVE-2015-32697: Cascading protection is not preventing file revisions Duplicate: T42426: Cascading protection should protect the file, not the description page Activity History Creator: Jackmcbroom Creation Date: Jun 15 2014, 9:56 PM Related Changes: - Change #233207: Cascade-protection: Files for files - Change #1112259: PermissionManager: Cascade protect file content, not wikitext - Change #1130586: [mediawiki/core] REL1_42 PermissionManager: Differentiate between cascading protection of file content and file pages - Change #1130587: [mediawiki/core] REL1_43 PermissionManager: Differentiate between cascading protection of file content and file pages - Change #1130588: [mediawiki/core] REL1_39 PermissionManager: Differentiate between cascading protection of file content and file pages Tags MediaWiki Page-protection (Cascade) MediaWiki Platform Team (In progress) User-notice-archive (Backlog) Subscribers Aklapper Danny7712 Eoi-Boss gerbrbot Jackmcbroom Krenair matmanrex

Goal Reached Thanks to every supporter — we hit 100%!

MediaWiki Cascading Protection Bypass on File Description Pages (CVE-2015-32697)