PT-2013-5080 · Mediawiki+1 · Mediawiki Cleanchanges Extension+1

Teles · Published 2013-12-13 · Updated 2014-02-07 · CVE-2013-4569

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki CleanChanges extension versions prior to 1.19.9 MediaWiki CleanChanges extension versions 1.20.x prior to 1.20.8 MediaWiki CleanChanges extension versions 1.21.x prior to 1.21.3

Description The issue allows remote attackers to obtain sensitive information, specifically revision-deleted IPs, via the Recent Changes page when the "Group changes by page in recent changes and watchlist" option is enabled.

Recommendations For versions prior to 1.19.9, update to version 1.19.9 or later. For versions 1.20.x prior to 1.20.8, update to version 1.20.8 or later. For versions 1.21.x prior to 1.21.3, update to version 1.21.3 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

ALT-PU-2014-1172

CVE-2013-4569

Affected Products

Alt Linux

Mediawiki Cleanchanges Extension

References · 28

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/mediawiki_thumb.rb · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5394 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6451 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6453 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2013-4569 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4572 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6455 · Security Note
• https://errata.altlinux.org/ALT-PU-2014-1172 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3455 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7444 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4574 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1610 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6472 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4570 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4569 · Security Note