CVE-2017-0371: 
Linux Debian vulnerability analysis and mitigation

MediaWiki before 1.23.16, 1.24.x through 1.27.x before 1.27.2, and 1.28.x before 1.28.1 contains a vulnerability that allows remote attackers to discover the IP addresses of Wiki visitors via a style="background-image: attr(title url);" attack within a DIV element that has an attacker-controlled URL in the title attribute (Wikimedia Phabricator).

The vulnerability exists in the CSS sanitizer functionality. The sanitizer rejects any inline CSS with "url(" to prevent web bugs, but a proposed update to attr() would allow circumvention of this check. The attack involves creating a span with a URL as title, where the inline CSS then adds a background image defined by that title interpreted as URL, enabling image loading from any domain (Wikimedia Phabricator).

If exploited, this vulnerability allows attackers to track Wiki visitors by discovering their IP addresses through web bug techniques. This represents a privacy concern as it enables unauthorized tracking of users visiting Wiki pages (Wikimedia Phabricator).

The issue was fixed in MediaWiki versions 1.23.16, 1.27.2, and 1.28.1. Users should upgrade to these versions or later to protect against this vulnerability. The fix involves rejecting CSS attr() with URL type in the sanitizer (Wikimedia Phabricator).