PT-2011-3357 · Mediawiki · Mediawiki

Liangent · Publicado 2011-05-23 · Atualizado 2011-06-16 · CVE-2011-1766

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.16.5

Description The issue allows remote attackers to bypass authentication by creating crafted wikiUserID and wikiUserName cookies, or by leveraging an unattended workstation, due to the failure to clear certain cached data after verification of an auth token fails when wgBlockDisablesLogin is enabled.

Recommendations For versions prior to 1.16.5, update to version 1.16.5 or later to resolve the issue. As a temporary workaround, consider disabling the wgBlockDisablesLogin feature until a patch is available. Restrict access to sensitive areas of the wiki to minimize the risk of exploitation. Avoid leaving workstations unattended while logged in to the wiki.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2011-1766

Produtos afetados

Mediawiki

Referências · 10

• http://lists.fedoraproject.org/pipermail/package-announce/2011-May/060507.html · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1766 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=702512 · Correção
• http://lists.fedoraproject.org/pipermail/package-announce/2011-May/060435.html · Aviso do Fabricante
• http://securityfocus.com/bid/47722 · Nota
• https://bugzilla.wikimedia.org/show_bug.cgi?id=28639 · Correção
• http://secunia.com/advisories/44684 · Nota
• http://lists.wikimedia.org/pipermail/mediawiki-announce/2011-May/000098.html · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2011-1766 · Nota de Segurança
• http://lists.fedoraproject.org/pipermail/package-announce/2011-May/060496.html · Aviso do Fabricante