Multiple cross-site scripting (XSS) vulnerabilities in the web-based installer (config/index.php) in MediaWiki 1.6 before 1.6.12, 1.12 before 1.12.4, and 1.13 before 1.13.4, when the installer is in active use, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Several vulnerabilities have been discovered in mediawiki1.7, a website engine for collaborative work. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-5249     David Remahl discovered that mediawiki1.7 is prone to a     cross-site scripting attack.

  - CVE-2008-5250     David Remahl discovered that mediawiki1.7, when Internet     Explorer is used and uploads are enabled, or an SVG     scripting browser is used and SVG uploads are enabled,     allows remote authenticated users to inject arbitrary     web script or HTML by editing a wiki page.

  - CVE-2008-5252     David Remahl discovered that mediawiki1.7 is prone to a     cross-site request forgery vulnerability in the     Special:Import feature.

  - CVE-2009-0737     It was discovered that mediawiki1.7 is prone to a     cross-site scripting attack in the web-based installer.

This update fixes the XSS vulnerabilities in 1.13.3 and splits the package into a non-math and a full package to allow for smaller installs where embedded math is not required.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
44766	Debian DSA-1901-1 : mediawiki1.7 - several vulnerabilities	Nessus	Debian Local Security Checks	medium
36780	Fedora 10 : mediawiki-1.14.0-45.fc10 (2009-2231)	Nessus	Fedora Local Security Checks	low
35756	Fedora 9 : mediawiki-1.14.0-45.fc9 (2009-2237)	Nessus	Fedora Local Security Checks	low

Detections

Analytics

CVE-2009-0737

medium

Tenable Plugins

medium

low

low