PT-2008-2909 · Wikimedia · Mediawiki

Published 2008-03-13 · Updated 2017-08-08 · CVE-2008-1318

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki versions 1.11 through 1.11.1

Description The issue allows remote attackers to obtain sensitive cross-site information via the callback parameter in an API call for JavaScript Object Notation (JSON) formatted results.

Recommendations For MediaWiki versions 1.11 through 1.11.1, update to version 1.11.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the API endpoint that handles JSON formatted results until the update is applied. Avoid using the callback parameter in API calls for JSON formatted results until the issue is resolved.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2008-1318

Affected Products

Mediawiki

References · 12

• http://secunia.com/advisories/29216 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-1318 · Vendor Advisory
• http://securityfocus.com/bid/28070 · Patch
• https://security-tracker.debian.org/tracker/CVE-2008-1318 · Vendor Advisory
• http://vupen.com/english/advisories/2008/0732/references · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2008-1318 · Vendor Advisory
• http://lists.wikimedia.org/pipermail/mediawiki-announce/2008-March/000070.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2008-1318 · Security Note
• http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_11_2/phase3/RELEASE-NOTES · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1318 · Note
• http://securitytracker.com/id?1019535 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/40960 · Note