Security readout for executives and security teams
Plain-English summary
Older MediaWiki releases could record passwords in plaintext inside api.log. The main business risk is credential exposure through local logs, backups, or log aggregation rather than direct remote takeover. If privileged user passwords were logged, follow-on account compromise is plausible.
Executive priority
Prioritize as a credential exposure cleanup. It is not presented as remote code execution, but leaked passwords can create account takeover risk, especially for administrator or reused credentials.
Technical view
MediaWiki before 1.28.1, 1.27.2, and 1.23.16 had an information disclosure flaw where api.log might contain plaintext passwords. Exposure depends on whether api.log existed, was retained, and who could access local, centralized, or backup log copies.
Likely exposure
Self-hosted MediaWiki deployments running versions before 1.28.1, 1.27.2, or 1.23.16, especially where api.log was enabled, preserved, exported, or broadly accessible to operators, backup systems, or log platforms.
Exploitation context
The provided sources do not show active exploitation, and the CVE is not listed as KEV. Practical abuse would require access to logs containing captured passwords, then misuse of those credentials.
Researcher notes
Evidence is limited to the disclosed flaw and fixed release references. No CVSS, CWE, exploitability details, or named configuration prerequisites were provided beyond possible plaintext passwords in api.log.
Mitigation direction
- Upgrade MediaWiki to 1.28.1, 1.27.2, 1.23.16, or a later supported fixed release.
- Restrict access to api.log, archived logs, backups, and centralized log stores.
- Search retained logs for plaintext password exposure using approved internal procedures.
- Rotate passwords for accounts whose credentials may have appeared in logs.
- Review vendor guidance before deleting logs needed for compliance or incident response.
Validation and detection
- Inventory MediaWiki versions and confirm whether any instance predates the fixed releases.
- Check whether api.log exists or existed during the affected deployment period.
- Review log retention, backup, and forwarding paths for api.log copies.
- Confirm permissions limit log access to authorized administrators only.
- Document any exposed accounts and verify password rotation completion.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-0361 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- [mediawiki-announce] 20170406 Security Release: 1.28.1 / 1.27.2 / 1.23.16CVE reference · mailing-list, x_refsource_MLIST
- https://security-tracker.debian.org/tracker/CVE-2017-0361CVE reference · x_refsource_CONFIRM
- https://phabricator.wikimedia.org/T125177CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.