PT-2014-6359 · Wikimedia+1 · Mediawiki+1

Publicado 2014-08-05 · Atualizado 2017-01-07 · CVE-2014-5241

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.19.18 MediaWiki versions 1.20.x through 1.22.x before 1.22.9 MediaWiki versions 1.23.x before 1.23.2

Description The issue concerns the JSONP endpoint in MediaWiki, which does not properly restrict certain long callback values and the initial bytes of a JSONP response. This allows remote attackers to conduct cross-site request forgery (CSRF) attacks and obtain sensitive information via a crafted OBJECT element with SWF content consistent with a restricted character set. The API endpoint in question is "includes/api/ApiFormatJson.php".

Recommendations For MediaWiki versions prior to 1.19.18, update to version 1.19.18 or later. For MediaWiki versions 1.20.x through 1.22.x before 1.22.9, update to version 1.22.9 or later. For MediaWiki versions 1.23.x before 1.23.2, update to version 1.23.2 or later.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

ALT-PU-2014-2021

CVE-2014-5241

DSA-3011-1

MGASA-2014-0309

Produtos afetados

Alt Linux

Mediawiki

Referências · 23

• 🔥 https://bugzilla.wikimedia.org/show_bug.cgi?id=68187 · Exploit
• https://bugzilla.wikimedia.org/show_bug.cgi?id=65778 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5241 · Nota de Segurança
• https://lists.wikimedia.org/pipermail/mediawiki-announce/2014-July/000157.html · Nota
• https://errata.altlinux.org/ALT-PU-2014-2021 · Aviso do Fabricante
• http://debian.org/security/2014/dsa-3011 · Aviso do Fabricante
• http://mandriva.com/security/advisories?name=MDVSA-2014:153 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-5241 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5243 · Nota de Segurança
• https://bugs.mageia.org/show_bug.cgi?id=13833 · Nota
• http://advisories.mageia.org/MGASA-2014-0309.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-5241 · Nota de Segurança
• http://secunia.com/advisories/59738 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5241 · Nota
• https://bugzilla.wikimedia.org/show_bug.cgi?id=66608 · Nota