The transwiki import functionality in MediaWiki before 1.16.3 does not properly check privileges, which allows remote authenticated users to perform imports from any wgImportSources wiki via a crafted POST request.

The remote host is affected by the vulnerability described in GLSA-201206-09 (MediaWiki: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in mediawiki. Please       review the CVE identifiers referenced below for details.
  Impact :

    MediaWiki allows remote attackers to bypass authentication, to perform       imports from any wgImportSources wiki via a crafted POST request, to       conduct cross-site scripting (XSS) attacks or obtain sensitive       information, to inject arbitrary web script or HTML, to conduct       clickjacking attacks, to execute arbitrary PHP code, to inject arbitrary       web script or HTML, to bypass intended access restrictions and to obtain       sensitive information.
  Workaround :

    There is no known workaround at this time.

Several problems have been discovered in MediaWiki, a website engine for collaborative work.

  - CVE-2011-1578 CVE-2011-1587     Masato Kinugawa discovered a cross-site scripting (XSS)     issue, which affects Internet Explorer clients only, and     only version 6 and earlier. Web server configuration     changes are required to fix this issue. Upgrading     MediaWiki will only be sufficient for people who use     Apache with AllowOverride enabled.

  For details of the required configuration changes, see the upstream   announcements.

  - CVE-2011-1579     Wikipedia user Suffusion of Yellow discovered a CSS     validation error in the wikitext parser. This is an XSS     issue for Internet Explorer clients, and a privacy loss     issue for other clients since it allows the embedding of     arbitrary remote images.

  - CVE-2011-1580     MediaWiki developer Happy-Melon discovered that the     transwiki import feature neglected to perform access     control checks on form submission. The transwiki import     feature is disabled by default. If it is enabled, it     allows wiki pages to be copied from a remote wiki listed     in $wgImportSources. The issue means that any user can     trigger such an import to occur.

  - CVE-2011-4360     Alexandre Emsenhuber discovered an issue where page     titles on private wikis could be exposed bypassing     different page ids to index.php. In the case of the user     not having correct permissions, they will now be     redirected to Special:BadTitle.

  - CVE-2011-4361     Tim Starling discovered that action=ajax requests were     dispatched to the relevant function without any read     permission checks being done. This could have led to     data leakage on private wikis.

This update brings mediawiki to version 1.16.4, which is the latest stable release at the moment, but currently also the only supported and recommended release by the mediawiki developer community.

Further changes :

  - some simple wiki management functionality was added :

    - mw-createinstance <path> creates a wiki instance under       <path>, which is autoupgraded upon package updates.

  - any wiki path entered in /etc/mediawiki/instances will     be autoupgraded upon package updates.

  - /var/www/wiki is entered into this list automatically,     but you can remove it if you don't want this instance to     be autoupgraded.

  - opensearch and suggestions are enabled by default

    - several bug fixes (see changelog).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update brings mediawiki to version 1.16.2, which is the latest stable release at the moment, but currently also the only supported and recommended release by the mediawiki developer community.

Further changes :

  - some simple wiki management functionality was added :

    - mw-createinstance <path> creates a wiki instance under       <path>, which is autoupgraded upon package updates.

  - any wiki path entered in /etc/mediawiki/instances will     be autoupgraded upon package updates.

  - /var/www/wiki is entered into this list automatically,     but you can remove it if you don't want this instance to     be autoupgraded.

  - opensearch and suggestions are enabled by default

    - several bug fixes (see changelog).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
59647	GLSA-201206-09 : MediaWiki: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
57506	Debian DSA-2366-1 : mediawiki - multiple vulnerabilities	Nessus	Debian Local Security Checks	medium
53609	Fedora 14 : mediawiki-1.16.4-58.fc14 (2011-5812)	Nessus	Fedora Local Security Checks	medium
53608	Fedora 13 : mediawiki-1.16.4-58.fc13 (2011-5807)	Nessus	Fedora Local Security Checks	medium
53567	Fedora 15 : mediawiki-1.16.4-58.fc15 (2011-5848)	Nessus	Fedora Local Security Checks	medium
53521	Fedora 15 : mediawiki-1.16.4-57.fc15 (2011-5495)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2011-1580

high

Tenable Plugins

high

medium

medium

medium

medium

medium