[prev in list] [next in list] [prev in thread] [next in thread]
List: oss-security
Subject: Re: [oss-security] CVE request: mediawiki
From: Josh Bressers <bressers () redhat ! com>
Date: 2010-07-29 14:11:46
Message-ID: 1823507182.33761280412706163.JavaMail.root () zmail01 ! collab ! prod ! int ! phx2 ! redhat ! com
[Download RAW message or body]
----- "Raphael Geissert" <geissert@debian.org> wrote:
> Hi,
>
> A data leakage and a XSS vulnerabilities were discovered in
> mediawiki.
>
> References:
> http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-July/000092.html
> https://bugzilla.wikimedia.org/show_bug.cgi?id=24565
>
I spy three flaws:
A data leakage vulnerability was discovered, affecting MediaWiki 1.8
and later. Public caching headers were incorrectly set on API
responses containing private data. By means of a CSRF-style attack,
this can lead to the disclosure of various types of private data
stored on a wiki. All users are advised to upgrade. Full details can
be found at:
https://bugzilla.wikimedia.org/show_bug.cgi?id=24565
Use CVE-2010-2787
A cross-site scripting (XSS) vulnerability was discovered in
profileinfo.php. The vulnerability is only exposed when the script is
explicitly enabled in LocalSettings.php, with $wgEnableProfileInfo = true.
Use CVE-2010-2788
A register_globals arbitrary inclusion vulnerability was discovered in
the 1.16 beta release series, in MediaWikiParserTest.php. This
vulnerability does not affect any stable MediaWiki release. It only
affects wikis which have PHP's register_globals feature enabled,
despite our strong advice to the contrary. Apache installations with
AllowOverride enabled may be protected against this vulnerability,
since there is a .htaccess file with "Deny from all" in the relevant path.
Use CVE-2010-2789
Thank.
--
JB
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic