PT-2010-2866 · Wikimedia Foundation · Mediawiki

Tstarling · Publicado 2010-04-20 · Atualizado 2023-02-13 · CVE-2010-1150

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Média

Vetor base

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.15.3 MediaWiki version 1.6.x prior to 1.16.0beta2

Description The issue allows remote authenticated users to conduct phishing attacks. This is achieved by arranging for a victim to login to the attacker's account and then execute a crafted user script, related to a "login CSRF" issue. The problem arises from the software not properly handling a correctly authenticated but unintended login attempt.

Recommendations For MediaWiki versions prior to 1.15.3, update to version 1.15.3 or later. For MediaWiki version 1.6.x prior to 1.16.0beta2, update to version 1.16.0beta2 or later.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2010-1150

DSA-2041-1

Produtos afetados

Mediawiki

Referências · 16

• 🔥 https://bugzilla.wikimedia.org/show_bug.cgi?id=23076 · Exploit
• http://download.wikimedia.org/mediawiki/1.15/mediawiki-1.15.3.patch.gz · Correção
• http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-April/000090.html · Aviso do Fabricante
• http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_16_0beta2/phase3/RELEASE-NOTES · Nota
• http://openwall.com/lists/oss-security/2010/04/07/1 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=580418 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-1150 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2010-1150 · Aviso do Fabricante
• http://debian.org/security/2010/dsa-2041 · Aviso do Fabricante
• http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_15_3/phase3/RELEASE-NOTES · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1150 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-1150 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2010-1150 · Aviso do Fabricante
• http://download.wikimedia.org/mediawiki/1.16/mediawiki-1.16.0beta2.patch.gz · Correção
• http://vupen.com/english/advisories/2010/1055 · Nota