SB2018041306 - Multiple vulnerabilities in MediaWiki MediaWiki

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2018041306

SB2018041306 - Multiple vulnerabilities in MediaWiki MediaWiki

Published: April 13, 2018 Updated: July 17, 2020

Security Bulletin ID SB2018041306
Severity
High
Patch available
YES
Number of vulnerabilities 10
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 10% Medium 50% Low 40%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 10 secuirty vulnerabilities.


1) Information disclosure (CVE-ID: CVE-2017-0361)

The vulnerability allows a local authenticated user to execute arbitrary code.

Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains an information disclosure flaw, where the api.log might contain passwords in plaintext.


2) Cross-site request forgery (CVE-ID: CVE-2017-0362)

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.


3) Open redirect (CVE-ID: CVE-2017-0363)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 has a flaw where Special:UserLogin?returnto=interwiki:foo will redirect to external sites.


4) Open redirect (CVE-ID: CVE-2017-0364)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw where Special:Search allows redirects to any interwiki link.


5) Cross-site scripting (CVE-ID: CVE-2017-0365)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a XSS vulnerability in SearchHighlighter::highlightText() with non-default configurations.


6) Input validation error (CVE-ID: CVE-2017-0366)

The vulnerability allows a remote authenticated user to read and manipulate data.

Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw allowing to evade SVG filter using default attribute values in DTD declaration.


7) Exposure of Resource to Wrong Sphere (CVE-ID: CVE-2017-0367)

The vulnerability allows a remote authenticated user to execute arbitrary code.

Mediawiki before 1.28.1 / 1.27.2 contains an unsafe use of temporary directory, where having LocalisationCache directory default to system tmp directory is insecure.


8) Input validation error (CVE-ID: CVE-2017-0368)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw making rawHTML mode apply to system messages.


9) Incorrect default permissions (CVE-ID: CVE-2017-0369)

The vulnerability allows a remote authenticated user to manipulate data.

Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw, allowing a sysops to undelete pages, although the page is protected against it.


10) Input validation error (CVE-ID: CVE-2017-0370)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw were Spam blacklist is ineffective on encoded URLs inside file inclusion syntax's link parameter.


Remediation

Install update from vendor's website.

References