PT-2019-4686 · Mediawiki · Mediawiki Oauth2 Client Extension

Justin Bull · Publicado 2019-08-19 · Atualizado 2023-03-08 · CVE-2019-15150

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MediaWiki OAuth2 Client extension versions prior to 0.4

Description A CSRF issue exists due to the OAuth2 state parameter not being checked in the callback function, allowing a remote attacker to perform a cross-site request forgery. This could potentially enable an attacker to carry out actions on behalf of another user without their knowledge or consent.

Recommendations For versions prior to 0.4, update to version 0.4 or later to resolve the issue. As a temporary workaround, consider implementing additional validation checks for the OAuth2 state parameter in the callback function to prevent CSRF attacks.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

BDU:2020-01058

CVE-2019-15150

Produtos afetados

Mediawiki Oauth2 Client Extension

Referências · 12

• https://github.com/Schine/MW-OAuth2Client/commit/6a4fe4500ddd72ad4e826d9d63b2d69512bd10d1 · Correção
• https://github.com/Schine/MW-OAuth2Client/releases/tag/v0.4 · Nota
• https://bdu.fstec.ru/vul/2020-01058 · Nota de Segurança
• http://openwall.com/lists/oss-security/2019/08/19/1 · Nota
• http://seclists.org/fulldisclosure/2019/Aug/25 · Nota
• https://seclists.org/bugtraq/2019/Aug/32 · Nota
• https://t.me/defcon_news/22950 · Publicação no Telegram
• https://vulmon.com/vulnerabilitydetails?qid=CVE-2019-15150&scoretype=cvssv2 · Nota
• https://osv.dev/vulnerability/CVE-2019-15150 · Aviso do Fabricante
• https://vulmon.com/vulnerabilitydetails?qid=CVE-2019-15150&scoretype=cvssv2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-15150 · Nota de Segurança
• http://packetstormsecurity.com/files/154140/MediaWiki-OAuth2-Client-0.3-Cross-Site-Request-Forgery.html · Nota