SB2014060208 - Multiple vulnerabilities in MediaWiki

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2014060208

SB2014060208 - Multiple vulnerabilities in MediaWiki

Published: June 2, 2014 Updated: August 10, 2020

Security Bulletin ID SB2014060208
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 vulnerabilities.


1) Input validation error (CVE-ID: CVE-2012-5391)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Session fixation vulnerability in Special:UserLogin in MediaWiki before 1.18.6, 1.19.x before 1.19.3, and 1.20.x before 1.20.1 allows remote attackers to hijack web sessions via the session_id. Per: http://cwe.mitre.org/data/definitions/384.html "CWE-384: Session Fixation"


2) Input validation error (CVE-ID: CVE-2012-5395)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Session fixation vulnerability in the CentralAuth extension for MediaWiki before 1.18.6, 1.19.x before 1.19.3, and 1.20.x before 1.20.1 allows remote attackers to hijack web sessions via the centralauth_Session cookie. Per: http://cwe.mitre.org/data/definitions/384.html "CWE-384: Session Fixation"


Remediation

Install update from vendor's website.

References