Cross-site request forgery (CSRF) vulnerability in the CentralAuth extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows remote attackers to hijack the authentication of users for requests that login via vectors involving image loading.

According to its version number, the instance of MediaWiki running on the remote host is affected by the following vulnerabilities :

  - Input validation errors exist that allow cross-site     scripting attacks. (CVE-2013-4567, CVE-2013-4568)

  - An error exists related to session IDs and HTTP headers     that allows an information disclosure. (CVE-2013-4572)

Additionally, the following extensions contain vulnerabilities but are not enabled or installed by default (unless otherwise noted) : 

  - An input validation error exists related to the     'CentralAuth' extension that allows cross-site request     forgery (CSRF) attacks. (CVE-2012-5394)

  - An error exists in the 'CleanChanges' extension that     allows an information disclosure related to     'revision-deleted' IP addresses. (CVE-2013-4569)

  - An input validation error exists in the     'ZeroRatedMobileAccess' extension that allows cross-site     scripting attacks. (CVE-2013-4573)

Note that Nessus has not tested for these issues but has instead relied on the application's self-reported version number.

- Kevin Israel (Wikipedia user PleaseStand) identified and     reported two vectors for injecting JavaScript in CSS     that bypassed MediaWiki's blacklist (CVE-2013-4567,     CVE-2013-4568).
    <https://bugzilla.wikimedia.org/show_bug.cgi?id=55332>

  - Internal review while debugging a site issue discovered     that MediaWiki and the CentralNotice extension were     incorrectly setting cache headers when a user was     autocreated, causing the user's session cookies to be     cached, and returned to other users (CVE-2013-4572).
    <https://bugzilla.wikimedia.org/show_bug.cgi?id=53032>

Additionally, the following extensions have been updated to fix security issues :

  - CleanChanges: MediaWiki steward Teles reported that     revision-deleted IP's are not correctly hidden when this     extension is used (CVE-2013-4569).
    <https://bugzilla.wikimedia.org/show_bug.cgi?id=54294>

  - ZeroRatedMobileAccess: Tomasz Chlebowski reported an XSS     vulnerability (CVE-2013-4573).
    <https://bugzilla.wikimedia.org/show_bug.cgi?id=55991>

  - CentralAuth: MediaWiki developer Platonides reported a     login CSRF in CentralAuth (CVE-2012-5394).
    <https://bugzilla.wikimedia.org/show_bug.cgi?id=40747>

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
71500	MediaWiki < 1.19.9 / 1.20.8 / 1.21.3 Multiple Vulnerabilities	Nessus	CGI abuses	medium
71150	Fedora 18 : mediawiki-1.19.9-1.fc18 (2013-21874)	Nessus	Fedora Local Security Checks	medium
71149	Fedora 19 : mediawiki-1.21.3-1.fc19 (2013-21856)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2012-5394

high

Tenable Plugins

medium

medium

medium