Cross-site scripting (XSS) vulnerability in MediaWiki before 1.6.11, 1.12.x before 1.12.2, and 1.13.x before 1.13.3, when Internet Explorer is used and uploads are enabled, or an SVG scripting browser is used and SVG uploads are enabled, allows remote authenticated users to inject arbitrary web script or HTML by editing a wiki page.

Several vulnerabilities have been discovered in mediawiki1.7, a website engine for collaborative work. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-5249     David Remahl discovered that mediawiki1.7 is prone to a     cross-site scripting attack.

  - CVE-2008-5250     David Remahl discovered that mediawiki1.7, when Internet     Explorer is used and uploads are enabled, or an SVG     scripting browser is used and SVG uploads are enabled,     allows remote authenticated users to inject arbitrary     web script or HTML by editing a wiki page.

  - CVE-2008-5252     David Remahl discovered that mediawiki1.7 is prone to a     cross-site request forgery vulnerability in the     Special:Import feature.

  - CVE-2009-0737     It was discovered that mediawiki1.7 is prone to a     cross-site scripting attack in the web-based installer.

Missing checks allowed remote attackers to conduct cross-site scripting (XSS) or cross-site request forgery (CSRF) attacks against MediaWiki (CVE-2008-5250, CVE-2008-5252).

This is a security release of MediaWiki 1.13.3. Some of the security issues affect *all* versions of MediaWiki except the versions released on Dec. 15th, so all site administrators are encouraged to upgrade.
CVEs assigned to the mentioned MediaWiki update: CVE-2008-5249 Cross-site scripting (XSS) vulnerability in MediaWiki 1.13.0 through 1.13.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. CVE-2008-5250 Cross-site scripting (XSS) vulnerability in MediaWiki before 1.6.11, 1.12.x before 1.12.2, and 1.13.x before 1.13.3, when Internet Explorer is used and uploads are enabled, or an SVG scripting browser is used and SVG uploads are enabled, allows remote authenticated users to inject arbitrary web script or HTML by editing a wiki page. CVE-2008-5252 Cross-site request forgery (CSRF) vulnerability in the Special:Import feature in MediaWiki 1.3.0 through 1.6.10, 1.12.x before 1.12.2, and 1.13.x before 1.13.3 allows remote attackers to perform unspecified actions as authenticated users via unknown vectors. As well as other two issue mentioned in the upstream announcement, treated as security enhancement rather than vulnerability fixes by upstream: CVE-2008-5687 MediaWiki 1.11 through 1.13.3 does not properly protect against the download of backups of deleted images, which might allow remote attackers to obtain sensitive information via requests for files in images/deleted/. CVE-2008-5688 MediaWiki 1.8.1 through 1.13.3, when the wgShowExceptionDetails variable is enabled, sometimes provides the full installation path in a debugging message, which might allow remote attackers to obtain sensitive information via unspecified requests that trigger an uncaught exception.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The MediaWiki development team reports :

Certain unspecified input is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Certain unspecified input related to uploads is not properly sanitised before being used. This can be exploited to inject arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when a malicious data is opened.
Successful exploitation may require that uploads are enabled and the victim uses an Internet Explorer based browser.

Certain SVG scripts are not properly sanitised before being used. This can be exploited to inject arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when a malicious data is opened. Successful exploitation may require that SVG uploads are enabled and the victim uses a browser supporting SVG scripting.

The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain operations when a logged in user visits a malicious site.

ID	Name	Product	Family	Severity
44766	Debian DSA-1901-1 : mediawiki1.7 - several vulnerabilities	Nessus	Debian Local Security Checks	medium
40064	openSUSE Security Update : mediawiki (mediawiki-506)	Nessus	SuSE Local Security Checks	medium
36263	Fedora 10 : mediawiki-1.13.3-42.fc10 (2008-11743)	Nessus	Fedora Local Security Checks	medium
35679	openSUSE 10 Security Update : mediawiki (mediawiki-5987)	Nessus	SuSE Local Security Checks	medium
35267	Fedora 9 : mediawiki-1.13.3-42.fc9 (2008-11802)	Nessus	Fedora Local Security Checks	medium
35265	Fedora 8 : mediawiki-1.13.3-41.99.fc8 (2008-11688)	Nessus	Fedora Local Security Checks	medium
35243	FreeBSD : mediawiki -- multiple vulnerabilities (61b07d71-ce0e-11dd-a721-0030843d3802)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2008-5250

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium