Cross-site request forgery in MediaWiki - CVE-2017-0362
Published: April 13, 2018 / Updated: July 17, 2020
Vulnerability identifier: #VU31320
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-0362
CWE-ID: CWE-352
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform cross-site request forgery attacks.
The vulnerability exists due to insufficient validation of the HTTP request origin. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.
Affected software
MediaWiki
Arch Linux
Fedora
mediawiki
Arch Linux
Fedora
mediawiki
How to mitigate CVE-2017-0362
Update to version 1.28.1.
MediaWiki - update to 1.28.1
mediawiki - update to 1.27.2-1.fc25
mediawiki - update to 1.27.2-1.fc25