PT-2008-6393 · Wikimedia Foundation · Mediawiki

David Remahl · Published 2008-12-19 · Updated 2009-10-14 · CVE-2008-5252

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions MediaWiki versions 1.3.0 through 1.6.10 MediaWiki versions 1.12.x before 1.12.2 MediaWiki versions 1.13.x before 1.13.3

Description A cross-site request forgery (CSRF) issue in the Special:Import feature allows remote attackers to perform unspecified actions as authenticated users via unknown vectors.

Recommendations For MediaWiki versions 1.3.0 through 1.6.10, update to a version outside of this range to resolve the issue. For MediaWiki versions 1.12.x before 1.12.2, update to version 1.12.2 or later. For MediaWiki versions 1.13.x before 1.13.3, update to version 1.13.3 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2008-5252

DSA-1901-1

DTSA-186-1

Affected Products

Mediawiki

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2008-5252 · Security Note
• https://osv.dev/vulnerability/CVE-2008-5252 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-December/msg01256.html · Vendor Advisory
• http://debian.org/security/2009/dsa-1901 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-December/msg01309.html · Vendor Advisory
• http://lists.wikimedia.org/pipermail/mediawiki-announce/2008-December/000080.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html · Vendor Advisory
• http://secunia.com/advisories/33133 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2008-5252 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-5252 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5252 · Note
• http://secunia.com/advisories/33349 · Note