PT-2015-4174 · Wikimedia+1 · Mediawiki+1

Pleasestand · Publicado 2014-12-03 · Atualizado 2015-01-06 · CVE-2014-9276

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MediaWiki versions 1.20.x through 1.22.x before 1.22.14 MediaWiki versions 1.23.x before 1.23.7 MediaWiki before 1.19.22

Description A cross-site request forgery (CSRF) issue exists in the Special:ExpandedTemplates page of MediaWiki when $wgRawHTML is set to true. This allows remote attackers to hijack the authentication of users with edit permissions for requests that involve cross-site scripting (XSS) attacks via the wpInput parameter, which is not properly handled in the preview.

Recommendations For MediaWiki versions 1.20.x through 1.22.x before 1.22.14, update to version 1.22.14 or later. For MediaWiki versions 1.23.x before 1.23.7, update to version 1.23.7 or later. For MediaWiki before 1.19.22, update to version 1.19.22 or later. As a temporary workaround, consider setting $wgRawHTML to false to minimize the risk of exploitation.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

ALT-PU-2014-2433

CVE-2014-9276

MGASA-2014-0506

Produtos afetados

Alt Linux

Mediawiki

Referências · 16

• https://lists.wikimedia.org/pipermail/mediawiki-announce/2014-November/000170.html · Aviso do Fabricante
• http://securitytracker.com/id?1031301 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9507 · Nota de Segurança
• https://osv.dev/vulnerability/MGASA-2014-0506 · Aviso do Fabricante
• https://phabricator.wikimedia.org/T73478 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9277 · Nota de Segurança
• http://openwall.com/lists/oss-security/2014/12/04/16 · Nota
• http://openwall.com/lists/oss-security/2014/12/03/9 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9276 · Nota de Segurança
• https://phabricator.wikimedia.org/T73111 · Nota
• https://errata.altlinux.org/ALT-PU-2014-2433 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-9276 · Nota de Segurança
• https://packages.altlinux.org/ru/vuln/CVE-2014-9276 · Nota
• https://bugs.mageia.org/show_bug.cgi?id=14711 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9276 · Nota