oss-sec mailing list archives
Re: CVE request: mediawiki
From: Josh Bressers <bressers () redhat com>
Date: Thu, 29 Jul 2010 10:11:46 -0400 (EDT)
----- "Raphael Geissert" <geissert () debian org> wrote:
Hi, A data leakage and a XSS vulnerabilities were discovered in mediawiki. References: http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-July/000092.html https://bugzilla.wikimedia.org/show_bug.cgi?id=24565
I spy three flaws: A data leakage vulnerability was discovered, affecting MediaWiki 1.8 and later. Public caching headers were incorrectly set on API responses containing private data. By means of a CSRF-style attack, this can lead to the disclosure of various types of private data stored on a wiki. All users are advised to upgrade. Full details can be found at: https://bugzilla.wikimedia.org/show_bug.cgi?id=24565 Use CVE-2010-2787 A cross-site scripting (XSS) vulnerability was discovered in profileinfo.php. The vulnerability is only exposed when the script is explicitly enabled in LocalSettings.php, with $wgEnableProfileInfo = true. Use CVE-2010-2788 A register_globals arbitrary inclusion vulnerability was discovered in the 1.16 beta release series, in MediaWikiParserTest.php. This vulnerability does not affect any stable MediaWiki release. It only affects wikis which have PHP's register_globals feature enabled, despite our strong advice to the contrary. Apache installations with AllowOverride enabled may be protected against this vulnerability, since there is a .htaccess file with "Deny from all" in the relevant path. Use CVE-2010-2789 Thank. -- JB
Current thread:
- CVE request: mediawiki Raphael Geissert (Jul 28)
- Re: CVE request: mediawiki Josh Bressers (Jul 29)